Microsoft security researchers have disclosed a campaign called TerminalFix that pushes fake Cloudflare CAPTCHA prompts on compromised websites to trick visitors into pasting and running commands directly in Windows Terminal or PowerShell, rather than the Windows Run dialog earlier ClickFix style campaigns relied on. Researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan wrote that the campaign then runs a multi stage intrusion involving DLL sideloading and a steganographically hidden payload, followed by Active Directory reconnaissance and the deployment of a Python based reverse tunnel backdoor that gives the attacker persistent, network level proxy access into the victim’s environment.
Why it matters to a SOC team: a reverse tunnel does not need an open inbound port to give an attacker durable access. It calls out from inside the network, which means it can slip past firewall rules written to block unsolicited inbound connections, and it survives many of the network level containment steps a team would normally reach for first. “This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization’s internal network through the reverse tunnel,” the researchers wrote in Microsoft’s advisory.
The original insight is about where this technique is evolving, not just what it does. ClickFix style social engineering has moved twice now: first from fake update prompts to fake CAPTCHAs, and now from the Run dialog to a full terminal window, which CyberTech covered in a separate campaign impersonating AI coding tools in our recent report on malvertising that spoofed Codex and Claude Code. Both campaigns exploit the same cultural shift: IT teams increasingly tell end users it is normal to paste a command into a terminal to fix something, which erodes the instinct that a terminal prompt from an unknown source should be treated with suspicion. Combined with the kind of credential and access weaknesses covered in our report on a recent identity bypass flaw, a single successful ClickFix style lure now has a clear path to full network access, not just one infected endpoint.
Source: Microsoft
