CERT24TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy a BackdoorLoading data…
CERT24Threat Observatory
Period

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy a Backdoor

Microsoft disclosed details of a new ClickFix variant called TerminalFix that directs users to run a malicious command in Windows Terminal or PowerShell. The campaign uses compromised websites and fake Cloudflare CAPTCHA verifications and targets organizations across multiple sectors.

← Back to intelligence

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy a Backdoor

Microsoft disclosed details of a new ClickFix variant called TerminalFix that directs users to run a malicious command in Windows Terminal or PowerShell. The campaign uses compromised websites and fake Cloudflare CAPTCHA verifications and targets organizations across multiple sectors.