TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex

Report facts: Microsoft describes TerminalFix as a new variant of the ClickFix social-engineering campaign that uses fake Cloudflare CAPTCHAs to trick users into pasting and executing attacker-supplied commands in Windows Terminal or PowerShell, establishing a reverse-tunnel backdoor. The technique shifts from the Windows Run dialog to terminal environments to better support complex commands and more robust persistence. RealGround analysis: While the reported campaign targets human users and OS terminals rather than AI systems directly, similar social-engineering and "copy/paste this command" patterns are increasingly used to coerce operators of AI agents, devops bots, or admin assistants into running malicious code or connecting to untrusted endpoints. Organizations using AI-assisted operations should harden workflows against unvetted command execution, implement least-privilege for terminals and automation tools, and train staff to treat any out-of-band instructions—whether from web pages or AI tooling interfaces—as potential execution vectors.