Microsoft named a campaign TerminalFix on 28 August 2026. The short version is a fake CAPTCHA that wants Windows Terminal, not the Run box. The post is "TerminalFix campaign deploys a reverse tunnel through a multistage intrusion." The authors and the date are on that page. This is the vendor note. It isn't a kit.

Server racks, no operator. Wikimedia Commons.