Campaign deploys a reverse tunnel through multistage intrusion

Reported 31 Aug 2026 by otx · Severity: medium

A sophisticated TerminalFix campaign, a variant of ClickFix, targets organizations by leveraging compromised websites displaying fake Cloudflare CAPTCHA overlays. Users are tricked into copying and executing malicious PowerShell commands in Windows Terminal. The attack deploys a