‘TerminalFix’ Malware Deploys Reverse‑Tunnel Backdoor Through Fake Cloudflare CAPTCHA in Windows Terminal

Microsoft disclosed a new offshoot of the ClickFix family, named TerminalFix, which targets Windows Terminal and PowerShell users by showing fake Cloudflare CAPTCHA screens. The ploy lures victims into copying and running a malicious command that sets up a reverse‑tunnel backdoor on the infected machine.

Where previous ClickFix operations used the Windows Run dialog to drop their payload, TerminalFix takes advantage of the now‑widely‑used Windows Terminal. Threat actors serve a webpage that imitates Cloudflare’s verification challenge, asking the visitor to complete a CAPTCHA. Once the bogus test is passed, the site shows a seemingly authentic command‑line snippet, urging the user to paste it into the terminal.

Executing the malicious command launches a PowerShell script which pulls extra components from a remote server and establishes a persistent reverse‑tunnel back to the attacker’s infrastructure. Through this tunnel the adversary gains unrestricted network reach, allowing data theft, lateral spread, and deployment of additional payloads. Researchers point out that reverse‑tunnel tactics bypass many conventional firewall policies, since outbound connections are usually permitted.

Microsoft’s assessment shows the operation aims at a wide spectrum of victims, from solo users to corporate settings that have embraced Windows Terminal for its modern command‑line features. By employing a recognizable Cloudflare CAPTCHA, attackers hope to reduce suspicion; users who regularly encounter such prompts on legitimate sites may fail to spot the fraud.

Specialists caution that this method highlights a move in social‑engineering toward more refined, platform‑targeted bait. With command‑line utilities now embedded in everyday workflows, attackers are tailoring their strategies to the environments users frequent. Companies should tighten policies that block arbitrary script execution, deploy application‑control tools, and train employees on the risks of copying commands from untrusted origins.

Microsoft advises users to confirm the source of any command prior to running it, maintain up‑to‑date Windows and its components, and, where feasible, disable automatic execution of downloaded scripts. It also calls on security teams to watch for atypical outbound connections that may signal a reverse‑tunnel, and to use network detection solutions capable of spotting the distinctive traffic signatures of these backdoors.