CyberProof released TerminalFix, a ClickFix spinoff that uses fake Cloudflare CAPTCHAs to trick users into running PowerShell and setting up persistence, reconnaissance, and ongoing network access.
Public source
Publisher name
Public post
A ClickFix spinoff just dropped: TerminalFix. It uses fake Cloudflare CAPTCHAs to trick users into running PowerShell, then sets up persistence, reconnaissance, and ongo…
Company
CyberProof
Defend against the threats that matter most.
- Industry
- Computer and Network Security
- Location
- Aliso Viejo, US
- Company size
- 201–500 employees
About CyberProof
CyberProof delivers threat-led (via Continuous Threat Exposure Management), co-managed security operations with the belief that better security is achieved through the right partnerships, technology and client experiences. Our cloud-first and AI-powered approach to security delivers industry-leading security services which drive real and measurable business outcomes. We believe that working closely with our clients and partners through a better security, together model, jointly empowers us to defend against the greatest of threats.
See moreDiscover more
Similar signals
Similar public activity from other companies.
Research & Knowledge
Tuskira
Tuskira published a Threat Brief on August 31, 2026 detailing how a TerminalFix campaign using fake Cloudflare verification prompts tricked users into pasting PowerShell commands.
Products & Services
Crimson7
Crimson7 launched Ph1shy v2.0.0 on BreachForums in June at $500, featuring WebSocket updates, custom templates, multi-server, multi-user, JavaScript execution in the victim's browser, and a hosted backend with mutual TLS authentication.
Research & Knowledge
Sapphire
Sapphire published a weekly threat brief observing TerminalFix, a new ClickFix variant that uses fake Cloudflare CAPTCHA pages to trick users into running malicious PowerShell commands.
Products & Services
watchTowr
watchTowr enhanced its Active Defense mitigation capabilities to match other types of exposure found by the watchTowr Platform, including dangling DNS records, abandoned cloud assets, and expired domains.
Products & Services
Blackpoint Cyber