TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor via Fake Cloudflare CAPTCHAs

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell.

While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex commands can be executed unnoticed.

The attack chain begins with a user visiting a compromised website presenting a fake Cloudflare CAPTCHA. The CAPTCHA interface claims the user's IP address has been flagged for suspicious activity and requires verification. To proceed, the victim is instructed to copy and paste a specific command into Windows Terminal or PowerShell.

Upon execution, the command deploys a reverse-tunnel backdoor. This backdoor establishes a persistent connection to a remote server controlled by the threat actor, enabling unauthorized access and control of the compromised system. Microsoft has assessed the technique as leveraging legitimate Windows interfaces, making it difficult to distinguish from normal operation without behavioral monitoring.

Microsoft has not released a specific patch for this variant, as the attack relies on social engineering rather than a software vulnerability. Mitigation focuses on user awareness and avoiding the execution of unknown commands from unverified sources.