Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel

Gbhackers •Eswar • August 29, 2026

A newly documented TerminalFix campaign is using fake Cloudflare CAPTCHA prompts to trick users into manually executing malicious PowerShell commands, ultimately turning compromised Windows devices into reverse-tunnel pivot points for attackers. Microsoft said the activity targets organizations through compromised websites that replace legitimate content with a convincing Cloudflare Turnstile-style “Verify you are human” overlay. Rather […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickFix Attack Wave Targets Windows Users with StealC Malware A new social engineering campaign named ClickFix is targeting Windows users by presenting fake CAPTCHA verification pages. Victims are led to compromised websites that display fraudulent Cloudflare security checks, tricking them into executing malicious PowerShell commands to deploy the StealC information stealer malware. 230 sources 35

Extracted Entities

Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)