TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

A cyberattack campaign has been identified that uses fake CAPTCHAs to deploy reverse-tunnel backdoors. The campaign, dubbed TerminalFix, employs a multistage intrusion method. The initial breach involves fake CAPTCHAs, which are used to trick users into executing malicious code. This code then facilitates the deployment of a reverse-tunnel backdoor, allowing attackers to gain unauthorized access to compromised networks.

The attack leverages several sophisticated techniques. According to Microsoft and The Hacker News, these include DLL sideloading and steganography. DLL sideloading involves replacing legitimate dynamic-link library files with malicious ones, while steganography hides malicious code within seemingly innocuous files. The use of these methods makes detection and mitigation more challenging.

The campaign has prompted warnings from cybersecurity experts. Which? has published guidance on how to spot fake CAPTCHAs, emphasizing the importance of user awareness in preventing such attacks.