TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has disclosed a ClickFix variant named TerminalFix that lures users into running malicious PowerShell/Windows Terminal commands via fake Cloudflare CAPTCHA pages on compromised websites. The command fetches a ZIP containing a legitimate binary and a rogue DLL that performs DLL sideloading; the malware retrieves steganographically hidden payloads from PNGs, establishes persistence (registry run keys and scheduled tasks), conducts Active Directory/domain reconnaissance, and deploys a Python-based reverse-tunnel backdoor (client.py) to tunnel arbitrary TCP traffic to attacker infrastructure (gitnow.dev:443), enabling internal network access and potential lateral movement.