Microsoft warns of TerminalFix attacks deploying reverse tunnels

Microsoft disclosed TerminalFix, a ClickFix variant directing users to Windows Terminal or PowerShell via fake Cloudflare CAPTCHAs on compromised sites. The multi-stage attack uses DLL sideloading, steganographic PNG payloads, and a Python reverse-tunnel implant for persistent network-level proxy access, enabling reconnaissance, privilege escalation, and ransomware deployment.