powershell news
4 stories
New Malware Uses Fake CAPTCHAs to Deploy Backdoor
A newly identified malware variant, dubbed TerminalFix by Microsoft, has been observed leveraging deceptive Cloudflare CAPTCHAs to trick users into executing malicious commands. This particular variant is notable for its method of operation, which involves manipulating users into running harmful instructions through Windows Terminal or PowerShell.
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
A new cyber campaign, dubbed TerminalFix, has been reported to be actively targeting organizations through a sophisticated, multi-stage intrusion process. This campaign, identified as a variant of the previously known ClickFix operation, primarily relies on social engineering to initiate the attack chain, specifically by deceiving users into executing malicious PowerShell commands. The initial…
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
A Mexican banking fraud campaign, identified as REF6045, is being actively managed by human operators who monitor infected systems and direct malicious activities. The initial infection vector involves deceptive CAPTCHA pages that trick users into executing a command, which then installs the SCMBANKER PowerShell toolkit. This toolkit, with components dating back to at least October 2025,…
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
A recent phishing campaign is distributing a variant of the PureLogs malware, designed to steal sensitive data from compromised Windows systems. The campaign employs a multi-stage attack chain involving obfuscated JavaScript, PowerShell, and process hollowing techniques.