https://www.live-feeds.com/feed/terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoorContinuously updated, source-cited coverage. https://www.live-feeds.com/feed/terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoorhttps://www.live-feeds.com/feed/terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoor#u54660Wed, 02 Sep 2026 09:20:37 +0000Microsoft has identified TerminalFix, a ClickFix variant that deploys backdoor malware via fake Cloudflare CAPTCHA pages. The attack tricks users into executing complex, multi-line PowerShell scripts within Windows Terminal. This process initiates a multi-stage sequence that establishes a reverse tunnel into the victim's corporate network. Some attackers are distributing these lures by abusing shared ChatGPT conversation links to deliver the NetSupport RAT.Why it mattersThe attack leverages social engineering to bypass traditional security by making users manually run malicious code. By u https://www.live-feeds.com/feed/terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoorhttps://www.live-feeds.com/feed/terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoor#u53379Tue, 01 Sep 2026 01:20:37 +0000Microsoft and other security researchers have identified a ClickFix variant called TerminalFix that targets corporate networks. The campaign uses fake Cloudflare CAPTCHA prompts on compromised websites to deceive users into executing malicious PowerShell commands within Windows Terminal. Once executed, these commands establish a reverse tunnel into the victim's network. The intrusion process involves a multistage attack that utilizes steganography and DLL sideloading to bypass security measures and maintain access to the breached systems.Why it mattersThis attack leverages social engineer