Microsoft warns of TerminalFix attacks deploying reverse tunnels
BLUF
A new ClickFix variant named TerminalFix is actively tricking users into executing PowerShell commands that establish unauthorized remote access.
NEWS
Microsoft has identified TerminalFix, a social engineering campaign using compromised websites to display fake Cloudflare CAPTCHA challenges. Victims are instructed to copy and paste malicious PowerShell scripts into Windows Terminal, which then deploys reverse tunnels for persistent attacker control. This technique bypasses traditional security by leveraging legitimate system tools and user trust in familiar web prompts.
Why I Care
This matters because it combines social engineering with living-off-the-land techniques to bypass endpoint detection, affecting any internet-facing organization or individual visiting compromised sites. The deployment of reverse tunnels allows attackers to maintain long-term access for data theft or lateral movement without raising immediate alarms.
Next Steps
Security teams should block PowerShell execution via AppLocker or Group Policy where not required and monitor for suspicious Windows Terminal activity immediately. Users must be trained to never copy-paste code from web prompts, even those mimicking CAPTCHA challenges, effective immediately. Organizations should review web traffic logs for connections to known compromised domains associated with this campaign.
Source: BleepingComputer ·