2026-08-30: A new ClickFix variant called TerminalFix is deploying reverse-tunnel backdoors through fake

Show Notes - 2026-08-30

Stories Covered: - Today: - TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor (https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html) - Berlin Government Faces 30 Bitcoin Ransom Demand (https://databreaches.net/2026/08/29/de-hackers-demand-30-bitcoin-from-berlin-as-sensitive-data-breach-widens/) - PEAR Ransomware Claims 1.4 TB Exfiltration from Texas Healthcare Provider (https://databreaches.net/2026/08/29/pear-leaks-data-allegedly-exfiltrated-from-south-plains-rural-health-services-while-sprhs-remains-silent/) - Two Ransomware Groups Target Interim HealthCare Franchises (https://databreaches.net/2026/08/29/two-different-groups-have-recently-attacked-interim-healthcare-entities-should-other-franchises-be-concerned/) - Hasbro Data Breach Exposed Employee Personal Information (https://www.securityweek.com/hasbro-data-breach-exposed-employee-personal-information/) - Click2Mail Website Actively Hijacked, Customer Payment Cards Sold to Fraudsters (https://databreaches.net/2026/08/29/scoop-some-click2mail-customers-will-soon-be-receiving-notification-of-a-data-security-incident/) - US Officials Backpedal on Claims Government Agencies Were Hacked by China (https://databreaches.net/2026/08/29/us-officials-backpedal-on-claims-that-government-agencies-were-hacked-by-chinese/) - Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE (https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html)

CVEs Referenced: CVE-2026-18431, CVE-2026-19598, CVE-2026-19632, CVE-2026-76581, CVE-2026-82222

Indicators of Compromise: Domains: gitnow[.]dev, bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev. IPs: 4.16.7.2

Full brief: https://carolinacleartech.com/brief/2026-08-30/