CTI · reviewed · 2026-08-29

Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1204 User Execution Execution
• T1574 Hijack Execution Flow Stealth
• T1027 Obfuscated Files or Information Stealth
• T1105 Ingress Tool Transfer Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

{
  "title": "TerminalFix Reverse Tunnel Deployment via Fake Cloudflare CAPTCHA",
  "id": "a4f1c8e2-7b3d-4a9e-b5f6-1d2e3c4a5b67",
  "status": "experimental",
  "description": "Detects PowerShell execution consistent with TerminalFix campaign that uses fake Cloudflare CAPTCHA overlays to trick users into pasting and executing malicious commands. The command typically downloads a ZIP archive and executes it via PowerShell.",
  "author": "Tia N. List",
  "date": "2026-08-29",
  "references": [
    "https://www.microsoft.com/en-us/security/blog/",
    "https://gbhackers.com/"
  ],
  "tags": [
    "attack.t1566",
    "attack.t1059",
    "attack.t1204",
    "attack.t1574",
    "attack.t1027",
    "attack.t1105"
  ],
  "logsource": {
    "product": "windows",
    "category": "process_creation"
  },
  "detection": {
    "selection": {
      "CommandLine|contains|all": [
        "Cloudflare",
        "Invoke-WebRequest",
        "Start-Process"
      ]
    },
    "selection2": {
      "CommandLine|contains|all": [
        "LockScreenContentServer",
        "dui70.dll"
      ]
    },
    "condition": "selection or selection2"
  },
  "falsepositives": [
    "Legitimate Cloudflare verification scripts"
  ],
  "level": "high"
}

References

• https://www.microsoft.com/en-us/security/blog/
• https://gbhackers.com/
• https://malware.news/
• https://cyberpress.org/