Microsoft warns of TerminalFix attacks deploying reverse tunnels
Microsoft has flagged a new attack technique called TerminalFix, a variant of ClickFix, that presents users with fake Cloudflare CAPTCHA prompts on compromised websites. The prompts trick people into manually running malicious PowerShell commands in Windows Terminal, which can establish reverse tunnels on the victim's machine.
Why this matters: This attack works by making you do the damage yourself. You see what looks like a routine CAPTCHA check on a normal website, follow the steps, and hand an attacker access to your machine. No exotic exploit needed. The reverse tunnel means they can stay connected and come back later. The people most at risk are those who would not think twice about following a CAPTCHA prompt — which is almost everyone. The lesson is not that users are gullible. It is that attackers are very good at making malicious actions look like ordinary ones.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.