New "TerminalFix" Malware Masquerades as Cloudflare CAPTCHA to Deploy Reverse‑Tunnel Backdoor via Windows Terminal

Microsoft disclosed a new member of the ClickFix family, named TerminalFix, which targets Windows Terminal and PowerShell users by showing fake Cloudflare CAPTCHA pages. The ploy lures victims into copying and running a malicious command that sets up a reverse‑tunnel backdoor on the infected machine.

Where previous ClickFix operations used the Windows Run dialog to drop their payload, TerminalFix takes advantage of the now‑widely adopted Windows Terminal. Threat actors serve a site that imitates Cloudflare’s verification challenge, asking the visitor to solve a CAPTCHA first. Once the bogus test is passed, the page presents a seemingly legitimate command‑line snippet, urging the user to paste it into the terminal.

Executing the malicious command triggers a PowerShell script which pulls extra components from a remote server and establishes a persistent reverse‑tunnel to the attacker’s infrastructure. Through this tunnel the threat actor obtains unrestricted network reach, facilitating data theft, lateral movement, and deployment of additional payloads. Researchers point out that the reverse‑tunnel technique bypasses many conventional firewall policies, since outbound traffic is usually permitted.

Microsoft’s assessment shows the campaign is aimed at a wide range of victims, from private users to corporate settings that have embraced Windows Terminal for its modern command‑line features. Deploying a recognizable Cloudflare CAPTCHA is meant to reduce suspicion; users who regularly encounter such challenges on legitimate sites might not spot the fraud.

Specialists caution that this method highlights a move in social‑engineering toward more refined, platform‑targeted bait. With command‑line utilities now embedded in everyday workflows, attackers are tailoring their approaches to the environments users frequent. Companies should tighten policies that limit arbitrary script execution, deploy application‑control tools, and train employees on the risks of copying commands from untrusted origins.

Microsoft advises users to confirm the source of any command prior to running it, maintain Windows and its components with the latest updates, and, where feasible, disable automatic execution of downloaded scripts. It also calls on security teams to watch for atypical outbound connections that may signal a reverse‑tunnel, and to use network‑detection solutions capable of flagging the distinctive traffic signatures of such backdoors.