Daily Cybersecurity News – August 30, 2026
TerminalFix Uses Fake Cloudflare CAPTCHAs for Reverse-Tunnel Backdoor
HighAttack chain overview
- Compromised site shows fake Cloudflare CAPTCHA and copies malicious PowerShell to clipboard.
- User pastes command into Terminal or PowerShell; ZIP with LockScreenContentServer.exe and dui70.dll is downloaded and sideloaded.
- Steganographic payloads extracted from PNGs; persistence via Run keys and scheduled tasks set.
- Active Directory recon and file-watch command loop established.
- Python reverse-tunnel implant connects via WebSocket for internal network proxy access.
What happened
Microsoft disclosed details of TerminalFix, a ClickFix variant that tricks users via fake Cloudflare CAPTCHA overlays on compromised websites into copying and executing a malicious PowerShell command in Windows Terminal or PowerShell.
The multi-stage chain downloads a ZIP containing the legitimate LockScreenContentServer.exe binary and a rogue dui70.dll for DLL sideloading. The DLL retrieves steganographic payloads hidden in PNG images from domains such as bestsocialmedianewspapper.com or offlineupdater.com, establishes persistence with Registry Run keys and scheduled tasks, performs Active Directory reconnaissance, and deploys a Python-based reverse-tunnel implant (client.py).
The implant tunnels arbitrary TCP traffic over an encrypted WebSocket to attacker infrastructure at gitnow.dev:443, turning the host into a network proxy.
Who is affected
Organizations across multiple sectors whose users visit compromised websites and follow the fake verification prompts on Windows systems.
Any Windows environment where standard users can freely launch Terminal or PowerShell is exposed. Scale is potentially broad because the lure starts from ordinary web browsing.
Why it matters
The reverse tunnel grants attackers persistent, direct access into the victim's internal network from the compromised host, enabling identification and reach to additional systems.
This access can be abused for privilege escalation, disabling security tools, data exfiltration, or ransomware deployment. The combination of social engineering, living-off-the-land binaries, steganography, and network-level proxying makes detection and containment harder for operators.
How it could have been prevented
Restrict PowerShell and Windows Run dialog execution for standard users via AppLocker, Windows Application Control, or Group Policy. Audit or block Win+R if not required for daily work.
Monitor for DLL sideloading indicators around signed binaries, enable PowerShell script block logging, and train users to recognize ClickFix-style fake CAPTCHA or error prompts that demand pasting commands.
Relevant professional terms
- ClickFix
- A social-engineering method in which fake CAPTCHA, error, or verification pages instruct victims to copy and paste a malicious command into a system dialog or terminal to supposedly fix a problem.
- DLL sideloading
- An attack technique that places a malicious DLL beside a legitimate executable so the Windows loader prefers the attacker-controlled library, letting code run under the trusted process's identity and reputation.
Five Critical WordPress Flaws Enable Site Takeover or RCE
CriticalCritical flaws at a glance
| CVE | Component | CVSS | Impact |
|---|---|---|---|
| CVE-2026-76581 | WPMU DEV Dashboard <=5.0.1 | 9.8 | Auth bypass / site takeover |
| CVE-2026-18431 | Avada <=7.16 + Fusion Builder | 9.8 | Arbitrary file write to RCE |
| CVE-2026-19632 | TranslatePress <=3.3.1 | 9.8 | Admin password-reset exposure |
| CVE-2026-19598 | Pods <=3.3.9 | 9.8 | Privilege escalation to admin |
| CVE-2026-82222 | GiveWP <=4.16.7.1 | 10.0 | RCE via deserialization |
What happened
Five critical vulnerabilities were disclosed in popular WordPress plugins and a theme that enable unauthenticated authentication bypass, account takeover, privilege escalation, or remote code execution.
CVE-2026-76581 (CVSS 9.8) is an authentication bypass in WPMU DEV Dashboard up to 5.0.1 when Hub SSO is enabled. CVE-2026-18431 (CVSS 9.8) is arbitrary file write leading to RCE in Avada theme up to 7.16 with Fusion Builder up to 3.16. CVE-2026-19632 (CVSS 9.8) exposes admin password-reset URLs in TranslatePress up to 3.3.1 under specific locale settings. CVE-2026-19598 (CVSS 9.8) allows privilege escalation to admin in Pods up to 3.3.9. CVE-2026-82222 (CVSS 10.0) is a deserialization flaw enabling RCE in GiveWP up to 4.16.7.1 via a broken safe-unserialize helper and gadget chain.
None are listed in CISA KEV and EPSS scores remain low (0.3-2.8 percent).
Who is affected
WordPress sites running the affected plugins or theme: WPMU DEV Dashboard <=5.0.1, Avada <=7.16 (with Fusion Builder <=3.16), TranslatePress <=3.3.1 (with automatic string saving and secondary language locale), Pods <=3.3.9, and GiveWP <=4.16.7.1 (with a published donation form and active gateway).
These are widely used components, so exposure spans a large population of public-facing sites, including those handling donations or multi-language content.
Why it matters
Unauthenticated attackers can achieve full site takeover or arbitrary code execution, allowing defacement, data theft, malware distribution, SEO spam, or pivoting into connected systems and user accounts.
Operators of e-commerce, nonprofit, or multi-site WordPress installations face immediate risk of complete compromise without any user interaction beyond visiting the site.
How it could have been prevented
Update each plugin and theme to the latest patched version as soon as vendors release fixes. Disable unused features such as Hub SSO, automatic string saving, or unnecessary payment gateways until patched.
Apply least-privilege principles to WordPress admin accounts, deploy a web application firewall with virtual patching rules, and regularly audit installed plugins for necessity and update status.
Relevant professional terms
- Authentication bypass
- A flaw that lets an attacker gain access to a protected account or function without supplying valid credentials or completing the normal login process.
- PHP object injection
- A vulnerability arising from unsafe deserialization of user-controlled data that allows an attacker to instantiate malicious objects and trigger gadget chains leading to remote code execution.
Brave Browser Adds Email Aliases to Evade Tracking
LowHow it works
- Create a free Brave Account and register your primary email.
- On a sign-up form, generate a new randomized alias (or right-click the email field).
- The site receives only the alias; mail is forwarded to your primary address after spam/malware checks.
- Deactivate an alias anytime to stop future delivery; notes stay local or end-to-end encrypted via Sync.
- Five free aliases at launch; Premium expansion and mobile coming later.
What happened
Brave browser version 1.94 introduces Email Aliases, a free feature that lets users generate disposable email addresses for signing up to websites and services.
Messages sent to an alias are automatically forwarded to the user's registered primary address while the real email stays hidden from the site. A free Brave Account (separate from Premium) is required for generation and forwarding; up to five aliases are included at launch, with a paid tier planned later.
Aliases and the primary address are stored encrypted. Forwarded messages receive only automated spam and malware filtering then are deleted from Brave servers within seconds. Account authentication uses the OPAQUE password-authenticated key exchange so passwords or hashes are never sent to Brave.
Who is affected
Desktop users of Brave 1.94 and later who create a free Brave Account and want to protect their primary email when registering for online services.
Mobile support is planned. Anyone concerned about cross-site tracking, spam, or breach-related phishing via email addresses benefits.
Why it matters
Email addresses act as persistent identifiers that websites store and that can leak in breaches, enabling long-term tracking, spam, and targeted phishing. Aliases break that linkage and reduce the blast radius of any single service compromise.
The feature complements Brave's existing data-isolation protections and gives operators and privacy-conscious users a practical tool without needing third-party services.
Relevant professional terms
- Email alias
- A disposable or secondary email address that forwards messages to a real inbox so the primary address never has to be shared with websites or services.
- OPAQUE
- A password-authenticated key exchange protocol (RFC 9807) that lets a client prove knowledge of a password to a server without ever transmitting the password or a hash of it, reducing exposure to server-side leaks and offline cracking.