Microsoft warns of TerminalFix attacks deploying reverse tunnels

TerminalFix, a ClickFix variant, uses fake Cloudflare CAPTCHAs to run malicious PowerShell in Windows Terminal. The multi-stage attack deploys a Python reverse tunnel over WebSocket to gitnow[.]dev:443, enabling network pivoting, lateral movement, and ransomware. Microsoft observed the attacks in the wild.