News Date: 2026-08-31
A deceptive browser verification can now give attackers something more valuable than control of one computer. Microsoft has uncovered a ClickFix variant called TerminalFix that uses fake Cloudflare CAPTCHA prompts to convince victims to execute malicious commands in Windows Terminal or PowerShell.
From Social Engineering to Network Access
The attack begins when a compromised website presents what appears to be a routine human-verification request. Instead of completing a legitimate CAPTCHA, the visitor is instructed to paste and run a command that has already been copied to the clipboard. This action starts a multistage infection process.
The initial command downloads an archive containing a legitimate signed executable and a malicious DLL. The attackers then use steganography to conceal additional components inside image files. These components are extracted and assembled on the victim's system before persistence is established through a scheduled task and a Registry Run key.
TerminalFix subsequently searches for valuable internal assets, including domain controllers, databases, backup servers, mail systems and network gateways. It also collects system details and enumerates Active Directory.
The Reverse Tunnel Changes the Risk
The most concerning component is a custom Python module that creates an encrypted WebSocket connection to attacker infrastructure. This reverse tunnel supports arbitrary TCP proxying, allowing the compromised endpoint to act as a bridge into systems that are not directly exposed to the internet.
In my view, this is what separates TerminalFix from many ordinary information-stealing campaigns. The victim is not merely installing malware. The victim is unintentionally placing an attacker-controlled access point inside the corporate perimeter.
Defensive Priorities
- Restrict and log PowerShell and Windows Terminal activity where practical.
- Alert when script interpreters launch from browsers or unusual parent processes.
- Monitor outbound encrypted WebSocket connections to unfamiliar infrastructure.
- Investigate unexpected scheduled tasks, Registry persistence and Python components.
- Train employees never to paste commands supplied by websites.
Organizations that confirm an infection should examine the wider environment for lateral movement and rotate credentials accessible from the affected endpoint. I believe security awareness programs must now treat requests to copy and execute commands as seriously as suspicious attachments. A polished CAPTCHA page should never be allowed to turn a user into the malware installer.