Microsoft warns of TerminalFix attacks deploying reverse tunnels via fake CAPTCHAs

Microsoft has issued a warning about a new ClickFix variant, TerminalFix, which uses fake Cloudflare CAPTCHA prompts on compromised websites to trick users into running malicious PowerShell commands in Windows Terminal. The attack deploys reverse tunnels for remote access, indicating an evolution of social engineering tactics. The full scope and attribution remain unclear, but the technique poses a significant threat to enterprise environments.