New Malware Variant TerminalFix Discovered

Microsoft has released details about a new malware variant known as TerminalFix. This variant belongs to the ClickFix family and aims to trick users into executing harmful commands in Windows Terminal or PowerShell. The malware uses fake CAPTCHAs to deceive victims and prompt them to execute the malicious commands. TerminalFix differs from previous ClickFix campaigns, which typically targeted the Windows Run dialog. Instead, TerminalFix focuses on Windows Terminal and PowerShell, increasing the likelihood that users will execute complex commands.

This technique could be particularly dangerous, as many IT professionals and developers regularly work with these tools. The malware is spread through phishing emails that appear to come from trusted sources. The emails contain links that lead to fake websites where users are prompted to solve a CAPTCHA. Upon successful completion of the CAPTCHA, the user is lured into executing a harmful command that installs a reverse tunnel backdoor. The reverse tunnel backdoor allows attackers to access and control the affected system.

This can lead to data loss, theft of sensitive information, and other security incidents. Microsoft has already taken measures to stop the spread of TerminalFix and recommends that users regularly update their systems and use security software. IT security experts warn of the increasing sophistication of such attacks. The use of fake CAPTCHAs is a new trend that demonstrates how cybercriminals attempt to bypass security measures. The combination of social engineering and technical manipulation makes it difficult for many users to recognize the threat.

Microsoft has informed the security community about the new threat and advises vigilance. Users should be cautious about clicking on suspicious links and ensure that their software is up to date. The security updates addressing this threat are already integrated into the latest versions of Windows. The malware variant TerminalFix is an example of the ever-evolving tactics of cybercriminals. Attackers are employing increasingly sophisticated methods to achieve their goals.

Microsoft has emphasized that combating such threats requires a joint effort from companies, security researchers, and users. The vulnerability exploited by TerminalFix could potentially affect millions of users. Microsoft has not released exact figures on the spread of the malware; however, the threat is serious. Security authorities advise reporting any suspicious activities and following security protocols. Microsoft plans to roll out the necessary security updates to all users by the end of September 2026. Users are urged to regularly check their systems and ensure that all security measures are implemented.