Microsoft researchers have identified a new social engineering attack called TerminalFix that tricks users into executing malicious commands through Windows Terminal or PowerShell by impersonating Cloudflare CAPTCHA verification screens.
TerminalFix represents an evolution of the ClickFix malware family. Where traditional ClickFix attacks direct victims to the Windows Run dialog box, TerminalFix exploits the command-line interface by creating fake Cloudflare CAPTCHA pages that appear legitimate. When users attempt to verify they are human, they receive instructions to copy and paste a command into Windows Terminal or PowerShell. The attacker leverages the terminal environment because it provides a cleaner execution path for complex payloads compared to the Run dialog.
The attack chain begins with a compromised website or malicious advertisement. The victim lands on a page displaying a fake Cloudflare CAPTCHA screen, a trusted security interface that users recognize and expect. The fake verification message instructs the user to copy a specific command and run it in their command-line interface to complete the verification process. Users comply because the Cloudflare branding creates false confidence in the legitimacy of the request.
Once executed, the command deploys a reverse-tunnel backdoor onto the victim's system. This backdoor establishes an outbound connection to attacker-controlled infrastructure, creating a persistent communication channel. The attacker gains the ability to execute arbitrary commands, exfiltrate data, install additional malware, or perform lateral movement within the victim's network.
The use of Windows Terminal and PowerShell amplifies the attack's effectiveness. These tools accept complex commands with obfuscation, encoding, and multi-stage payload delivery mechanisms. Defenders cannot easily detect malicious activity at first glance because the command syntax appears legitimate to casual inspection. PowerShell's scripting capabilities allow attackers to bypass execution policies and security controls.
Organizations face particular risk. Compromised systems inside corporate networks grant attackers access to sensitive data, internal services, and lateral movement opportunities. Employees trained to use command-line tools may feel more confident executing terminal commands, especially when prompted by a familiar security interface like Cloudflare's CAPTCHA.
TerminalFix campaigns target Windows users broadly, but the technical sophistication suggests the attackers focus on mid-sized to large organizations rather than isolated individuals. The reverse-tunnel backdoor enables long-term persistent access, indicating the threat actors intend to maintain presence for espionage, data theft, or future attacks.
Mitigation requires user awareness training focused on command-line execution. Users should never copy and execute terminal commands from websites or pop-up messages, regardless of the branding or urgency presented. Organizations should restrict PowerShell execution policies, disable unnecessary terminal features, and monitor for suspicious command execution patterns. Endpoint detection and response (EDR) tools can flag suspicious reverse-shell traffic and command execution from browsers.
Microsoft recommends organizations review their user training programs to address the terminal-based attack vector. Traditional phishing awareness often focuses on email and Run dialog attacks. TerminalFix exploits a gap in user knowledge about the dangers of command-line execution triggered by web-based prompts.