TerminalFix campaign deploys a reverse tunnel through multistage intrusion
2026-08-31T08:52:11Z•f098357a5aaf797f2028a0277b4afb44dccd89c465cd45ccdc5ae8dc66e1950b
AI infrastructureCNAPPClickFixDLL sideloadingDeadLock ransomwareLiteLLMMDRMacSync StealerRustTerminalFixbrowser fingerprintingcloud securitycredential theftcryptominingdecentralized infrastructuredouble extortionfake CAPTCHAinfostealermacOSmultistage intrusionpersistenceransomwarereverse tunnelthreat intelligence
What happened
Microsoft Threat Intelligence reporting highlights multiple active cyber threats, including the TerminalFix ClickFix campaign using fake CAPTCHA prompts, DLL sideloading, multistage intrusion, and reverse tunneling; attacks targeting exposed LiteLLM AI gateways for credential theft, persistence, and cryptomining; MacSync Stealer infrastructure rotation; DeadLock Rust-based ransomware with decentralized recovery and leak infrastructure; and macOS ClickFix campaigns using browser-fingerprinting gates to conceal infostealer lures. The collection also includes security product and industry updates
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- f098357a5aaf797f2028a0277b4afb44dccd89c465cd45ccdc5ae8dc66e1950b
- Enrichment time
- 2026-08-31T08:52:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.