TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence reports on active threats including the TerminalFix ClickFix campaign, which uses fake CAPTCHA prompts, DLL sideloading, multistage intrusion, and reverse tunneling; attacks against exposed AI gateways involving credential theft, persistence, and cryptomining; MacSync Stealer infrastructure; DeadLock ransomware with Rust-based encryption and decentralized double-extortion infrastructure; and a macOS ClickFix campaign using browser-fingerprinting gates to conceal infostealer lures. The feed also contains product and industry announcements.