DLL Side-Loading

TerminalFix Campaign Exploits Fake CAPTCHA to Plant a Reverse Tunnel Inside Enterprise Networks

Microsoft Threat Intelligence identified a ClickFix-style attack campaign that uses fake Cloudflare CAPTCHA pages to trick users into running PowerShell commands, then deploys a multistage payload that ultimately creates a reverse WebSocket tunnel, giving the attacker the ability to relay TCP traffic through the compromised device.