New ‘TerminalFix’ Malware Uses Fake Cloudflare CAPTCHA to Install Reverse‑Tunnel Backdoor via Windows Terminal

Microsoft has revealed a fresh variant of the ClickFix malware family, dubbed TerminalFix, that exploits users of Windows Terminal and PowerShell by presenting counterfeit Cloudflare CAPTCHA pages. The scheme is designed to coax victims into copying and executing a malicious command, which then establishes a reverse‑tunnel backdoor on the compromised system.

Unlike earlier ClickFix campaigns that relied on the Windows Run dialog to deliver the payload, TerminalFix leverages the increasingly popular Windows Terminal interface. Attackers host a web page that mimics Cloudflare’s verification challenge, prompting the user to solve a CAPTCHA before proceeding. After the user completes the fake test, the page displays a command line snippet that appears legitimate, encouraging the victim to paste it into the terminal.

The malicious command initiates a PowerShell script that downloads additional components from a remote server and opens a persistent reverse‑tunnel to the attacker’s infrastructure. This tunnel grants the threat actor unrestricted network access, enabling data exfiltration, lateral movement, and further payload deployment. Security researchers note that the reverse‑tunnel approach circumvents many traditional firewall rules, as outbound traffic is typically allowed.

Microsoft’s analysis indicates that the campaign targets a broad audience, from individual users to enterprise environments where Windows Terminal is adopted for its modern command‑line capabilities. The use of a familiar Cloudflare CAPTCHA is intended to lower suspicion; users accustomed to seeing such challenges on legitimate sites may not recognize the deception.

Experts warn that the technique underscores a shift in social‑engineering tactics toward more sophisticated, platform‑specific lures. As command‑line tools become integral to daily workflows, attackers are adapting their methods to meet users where they operate. Organizations are advised to reinforce policies that restrict the execution of arbitrary scripts, employ application control solutions, and educate staff about the dangers of copying commands from unverified sources.

Microsoft recommends that users verify the origin of any command before execution, keep Windows and its components up to date, and consider disabling the automatic execution of downloaded scripts when possible. The company also urges security teams to monitor for unusual outbound connections that could indicate a reverse‑tunnel has been established, and to employ network detection tools that can flag the characteristic traffic patterns of such backdoors.