Fake CAPTCHAs Used in TerminalFix Campaign to Deploy Reverse Tunnel

A new TerminalFix campaign, a variant of ClickFix, has been discovered by Microsoft. This campaign uses fake Cloudflare CAPTCHA prompts to trick users into executing PowerShell commands that install a reverse-tunnel implant.

The infection begins on compromised websites that replace content with a convincing Cloudflare Turnstile-style overlay. After a victim clicks the “Verify you are human” prompt, the site copies a malicious command to the clipboard and instructs the user to open Windows Terminal or PowerShell and paste it.

The observed command downloads a ZIP archive, extracts it under a hidden ProgramData directory, and launches a batch file in the background. The malware establishes persistence via a Registry Run key and a scheduled task that restarts LockScreenContentServer.exe every 60 minutes.