Microsoft has identified a new cyber threat called TerminalFix, a variant of the ClickFix attack method. This campaign targets users through compromised websites displaying fake Cloudflare CAPTCHA prompts. Victims are tricked into running malicious PowerShell commands within Windows Terminal, leading to unauthorized access and potential data theft.
The attack begins when users visit a compromised website that displays a convincing Cloudflare CAPTCHA verification window. Instead of a standard CAPTCHA challenge, the prompt instructs users to open Windows PowerShell or a command-line interface and paste a specific command. This command appears legitimate but actually downloads and executes malicious payloads through reverse tunneling techniques. Unlike traditional ClickFix attacks that typically deliver infostealer malware, TerminalFix focuses on establishing persistent remote access to victim systems.
The success of TerminalFix relies heavily on social engineering tactics that exploit user familiarity with security measures. By mimicking the widely recognized Cloudflare CAPTCHA system, attackers create a false sense of security. Users who regularly encounter these verification prompts during normal browsing are more likely to comply with the unusual instructions presented. Microsoft researchers note that the malicious commands are designed to appear as routine troubleshooting steps, further reducing suspicion among targeted individuals.
Security experts highlight several key differences between TerminalFix and earlier ClickFix campaigns. Traditional variants typically redirect users to phishing pages or prompt them to download obvious malware files. TerminalFix instead leverages built-in Windows tools like PowerShell and Windows Terminal, making detection more challenging for both users and security software. The use of reverse tunneling allows attackers to maintain covert communication channels with compromised machines, enabling long-term surveillance and data exfiltration without triggering network-based security alerts.
The emergence of TerminalFix represents a significant evolution in browser-based attack methodologies. By combining familiar user interface elements with sophisticated backend techniques, this campaign demonstrates how cybercriminals continue adapting to improved security awareness among internet users. Organizations are advised to implement strict policies regarding command-line tool usage and provide additional training on identifying social engineering attempts that bypass traditional malware detection systems.
What should users do if they encounter a fake CAPTCHA asking them to run commands? Users should immediately close the browser tab and never execute commands from unfamiliar sources. Legitimate CAPTCHA systems never require users to run PowerShell or command-line instructions.
How can organizations protect against TerminalFix attacks? Companies should restrict access to PowerShell and command-line interfaces for non-administrative users, implement application whitelisting, and deploy endpoint detection and response solutions that monitor for unusual process execution patterns.
Are existing antivirus solutions effective against TerminalFix? Traditional signature-based antivirus may miss TerminalFix attacks since they use legitimate Windows tools. Behavioral analysis and machine learning-based security solutions offer better protection by identifying anomalous usage patterns.