TerminalFix Attack Uses Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks

The attack begins on compromised websites displaying a convincing fake Cloudflare Turnstile CAPTCHA. The page shows a “Verify you are human” prompt, Cloudflare branding, and a loading animation. When users click the verification box, a malicious PowerShell command is copied to their clipboard. They are then told to open Windows Terminal or...