TerminalFix Campaign Exploits Fake Cloudflare CAPTCHAs for Reverse Tunneling

The TerminalFix campaign has been identified using fraudulent Cloudflare CAPTCHA prompts to deceive users into executing harmful PowerShell commands. This tactic converts compromised Windows devices into reverse-tunnel pivot points for attackers. Microsoft has confirmed that the campaign targets organizations through compromised websites that display a convincing overlay mimicking Cloudflare's 'Verify you are human' CAPTCHA. The attack primarily affects Windows systems, with no specific numbers of affected organizations reported. The current status of the campaign indicates ongoing exploitation, as users are tricked into executing the malicious commands. Organizations are advised to remain vigilant against such deceptive tactics.

Key Points: • TerminalFix uses fake Cloudflare CAPTCHAs to deploy malicious PowerShell commands. • The campaign targets Windows devices, turning them into reverse-tunnel points for attackers. • Microsoft has confirmed the ongoing exploitation of this tactic against organizations.