New TerminalFix Malware Targets Windows Users Through Deceptive CAPTCHA Prompts

Exploiting Terminal Command Vulnerabilities

Microsoft security researchers have identified a dangerous new malware strain known as TerminalFix. This campaign uses fake Cloudflare CAPTCHA screens to deceive users into executing malicious code. By targeting Windows Terminal and PowerShell, the attackers gain unauthorized access to compromised systems, posing a significant threat to corporate and personal network security worldwide.

The attack begins when users encounter a fraudulent security verification page. This page mimics a standard Cloudflare CAPTCHA, urging the visitor to perform a human verificationstep. Instead of protecting the site, the prompt instructs the user to copy and paste a hidden, malicious script into their Windows command interface.

Once the user pastes the command into PowerShell or Windows Terminal, the script executes immediately. This action establishes a reverse-tunnel backdoor, granting cybercriminals persistent remote access to the machine. Unlike older versions of this attack that relied on the Windows Run dialog, this method exploits the elevated capabilities of modern terminal applications.

How Can Users Identify These Deceptive Prompts?

The shift toward terminal-based execution allows attackers to bypass certain security filters. By leveraging legitimate system tools, the malware remains hidden from basic detection methods. This technique effectively turns the user’s own administrative tools against them, facilitating data theft and further malware deployment across the affected network.

Security experts emphasize that legitimate websites never require users to copy and paste code into a terminal to prove they are human. If a site requests such an action, it is almost certainly an attempt to compromise the system. Users should remain vigilant and avoid interacting with any unexpected pop-ups that demand manual command execution.

The long-term consequences of a TerminalFix infection are severe. Attackers can exfiltrate sensitive credentials, install ransomware, or use the compromised device as a pivot point for lateral movement. Organizations must prioritize endpoint monitoring and restrict the ability of standard users to execute unauthorized scripts in PowerShell to mitigate this evolving threat.

Frequently Asked Questions

What is the primary goal of the TerminalFix campaign? The campaign aims to trick users into running malicious scripts that open a reverse-tunnel backdoor, allowing attackers to take control of the victim's computer.

How does the malware trick the user? It presents a fake security verification screen that mimics a Cloudflare CAPTCHA, instructing the user to copy and paste a harmful command into their terminal.

What should users do if they encounter this prompt? Users should immediately close the browser window and avoid pasting any text into their terminal. Never execute commands provided by unknown or suspicious websites.