Microsoft warns fake CAPTCHA is tricking Windows users into running malware

The pages impersonate Cloudflare and other trusted services. Instead of presenting a normal CAPTCHA challenge, they instruct users to open PowerShell or Command Prompt and paste ...
CSO Online

Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers

TerminalFix tricks victims into running malicious PowerShell commands, launching a multi-stage attack that ends with a ...
Tech Times

LM Studio Bionic Clears 82% of Shell Commands Without AI; Reviewer Yields to Prompt Injection

Auto Review’s AST analysis clears 82% of shell commands without an AI call, but the Shell Reviewer can still be reached by ...

Microsoft warns of TerminalFix attacks deploying reverse tunnels

A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into ...

TerminalFix Attacks Use Fake CAPTCHAs To Secretly Hack Windows PCs

Microsoft Threat Intelligence has discovered TerminalFix, a campaign that uses fake CAPTCHAs to trick users into running PowerShell scripts.
Hackread

Microsoft Warns of TerminalFix Campaign Hiding Malware in PNG Images

TerminalFix uses fake Cloudflare CAPTCHA pages to trick users into running PowerShell malware, creating reverse tunnels that ...

Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines

An unknown miscreant is using "TerminalFix" to trick unsuspecting users into running PowerShell commands that infect their ...
Security Boulevard

Detecting living-off-the-land binaries with Sysmon process events

Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The ...
Windows Report on MSN

Microsoft Warns Fake Cloudflare CAPTCHAs Are Spreading TerminalFix Malware

TerminalFix is a new ClickFix campaign that tricks users into running PowerShell commands and turns infected Windows PCs into network pivots.
XDA Developers on MSN

Your Windows 11 default hibernation file is quietly eating 32GB of SSD write cycles, and here is the one-command fix

And it might be causing long term damage to your drive.

New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal

Microsoft is calling it "TerminalFix" and says it is used to deliver "complex, multi-line scripts".
Microsoft

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based ...