TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence reporting covers active and emerging threats including the TerminalFix multistage ClickFix campaign using fake CAPTCHA prompts, DLL sideloading, and reverse tunneling; attacks against exposed AI gateways involving credential theft, persistence, and cryptomining; MacSync Stealer infrastructure rotation; DeadLock ransomware with double extortion and decentralized victim infrastructure; and macOS ClickFix campaigns using browser-fingerprinting gates. The feed also contains general Microsoft product, market, and security strategy announcements.