> TritonInfoSec News
Home / Aug 31, 2026 / Story
0
#2 The Hacker News general August 30, 2026 at 07:36 UTC

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

By [email protected] (The Hacker News)

AI Summary

Microsoft disclosed details of TerminalFix, a new ClickFix variant that directs victims to execute malicious commands in Windows Terminal or PowerShell rather than the traditional Run dialog, deploying a reverse-tunnel backdoor via fake Cloudflare CAPTCHA pages. The shift to Terminal/PowerShell increases attack sophistication and likelihood of success against technical users who may not recognize the lure. Defenders should monitor for unexpected PowerShell or Windows Terminal invocations spawned from browser processes.

Read full article → https://thehackernews.com/2026/08/terminalfix-uses…

Relevance score: 86.0/100

# More from August 31

  1. 1
    Chrome Web Store extensions caught stealing crypto, browser data BleepingComputer
  2. 3
    Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE The Hacker News
  3. 4
    Anthropic warns infostealer malware is hijacking Claude sessions to drain usage BleepingComputer
  4. 5
    FulcrumSec claims Manchester Airports hack, theft of 86 GB of data BleepingComputer
  5. 6
    Hasbro Data Breach Exposed Employee Personal Information SecurityWeek
  6. 7
    I asked 100 companies for my data. Some deleted it instead. Ars Technica Security
  7. 8
    Brave browser adds email aliases to help users evade tracking BleepingComputer
  8. 9
    A 12TB Steam “teraleak” spills more than a decade of lost PC gaming history Ars Technica Security
  9. 10
    Anthropic is cutting Claude Code's current weekly limits by 17% BleepingComputer