Most people have completed hundreds of CAPTCHAs.
Click the traffic lights. Find the bicycles. Tick “I’m not a robot”.
We have become so accustomed to them that we barely question what happens next.
Cyber criminals know that.
Microsoft Threat Intelligence has identified a campaign it calls TerminalFix, a variation of the increasingly common ClickFix social engineering technique. It uses a convincing fake Cloudflare CAPTCHA to persuade the person sitting at the computer to execute the attack themselves.
That sounds remarkably simple. What happens afterwards isn’t.
What is TerminalFix?
According to Microsoft, the attack starts when someone visits a compromised website.
A fake Cloudflare Turnstile verification screen appears and asks the visitor to prove they are human.
When the person interacts with it, malicious code is silently copied to their clipboard. Instructions then tell them to open Windows Terminal or PowerShell and paste the command.
Traditional ClickFix attacks have often used the Windows Run box. TerminalFix instead directs victims towards Terminal or PowerShell, allowing attackers to execute more complicated multi-line scripts.
The important point is that the victim isn’t exploiting their own computer deliberately.
They believe they’re completing a perfectly ordinary verification process.
What happens if you follow the instructions?
This is where TerminalFix becomes considerably more serious.
The initial PowerShell command downloads a ZIP archive containing a legitimate signed Microsoft executable alongside a malicious DLL.
The attackers use DLL sideloading to execute their malicious code through that legitimate process.
Additional components are then retrieved in an unusual way. Microsoft found executable code concealed inside the pixel data of PNG images using steganography. The malware extracts those components and reconstructs them on the computer.
Persistence is established using Registry Run keys and scheduled tasks.
The infected computer then starts looking around.
Microsoft observed reconnaissance including Active Directory enumeration, identification of domain administrators, system information collection and searches for potentially interesting systems on the network.
The really concerning bit: the reverse tunnel
Perhaps the most significant part of the attack is what comes next.
TerminalFix deploys a custom Python-based reverse tunnel communicating over an encrypted WebSocket connection.
Rather than an attacker having to establish a conventional inbound connection through your firewall, the compromised computer makes an outbound connection.
The attacker can then potentially use that connection as a route back into resources accessible from the infected machine.
Think of it less like somebody trying to break down your front door and more like somebody inside the building opening a side door for them.
Microsoft describes the infected endpoint as a potential network pivot point.
That distinction matters enormously.
A single compromised laptop is no longer necessarily the end of the incident.
It could become the beginning of an attack on the wider network.
Does TerminalFix lead to ransomware?
Potentially, but we need to be careful here.
Microsoft says it did not observe the downstream hands-on-keyboard activity in the campaign it analysed.
However, the access created by TerminalFix could provide the opportunity for subsequent privilege escalation, credential theft, security-tool disabling, data exfiltration and ransomware deployment.
That’s an important distinction.
There is enough frightening nonsense written about cyber security without turning “could” into “did”.
Why the human element is interesting
There is some impressive technical work behind TerminalFix.
DLL sideloading. Steganography. PowerShell. Persistence mechanisms. Active Directory reconnaissance. Reverse WebSocket tunnels.
But none of it happens until somebody follows some instructions on a webpage.
That doesn’t make the employee the “weakest link”.
It makes the social engineering the first stage of the attack.
Attackers are exploiting a behaviour that legitimate websites have spent years teaching us.
When a CAPTCHA appears, we expect to follow its instructions.
Most people don’t analyse why a website needs them to tick a box or select three traffic lights. They simply want to get to whatever is behind it.
TerminalFix takes advantage of that expectation.
The request becomes slightly more unusual, but the context helps make it believable:
“I’m proving I’m human.”
That’s why security awareness can’t simply consist of telling staff not to click suspicious links.
People need examples of how attacks actually work today.
One rule worth sharing with your staff
Fortunately, there is a wonderfully simple lesson organisations can take from this attack:
A legitimate CAPTCHA should not require you to open PowerShell, Windows Terminal or the Windows Run dialog and paste a command into it.
If a website tells you to do that, stop.
Don’t paste the command.
Don’t try it “just to see what happens”.
Close the page and report it to whoever manages your IT or cyber security.
That single piece of advice is probably more useful to the average employee than explaining DLL sideloading or WebSocket tunnels.
Training isn’t the whole answer
Microsoft also recommends technical controls, including restricting PowerShell where appropriate, considering restrictions or auditing around the Windows Run dialog, monitoring suspicious execution of LockScreenContentServer.exe, strengthening endpoint and browser protections, and educating users about ClickFix techniques.
For organisations, that reinforces a wider point.
Don’t make your security depend on every member of staff making the perfect decision every time.
Someone will eventually click something they shouldn’t.
Someone will eventually believe a convincing message.
Someone will eventually make a mistake.
Good security assumes that will happen and puts layers around them.
Endpoint detection and response, sensible application controls, restricted privileges, monitoring, network segmentation and a culture where people feel comfortable reporting mistakes quickly can all reduce what happens next.
The objective isn’t to create employees who never make mistakes.
It’s to make one mistake considerably less expensive.
What should organisations do now?
If you’re responsible for IT, I’d use TerminalFix as an opportunity to talk to staff about ClickFix-style attacks.
Show them what a fake CAPTCHA looks like.
Explain why copying commands into PowerShell, Terminal or the Run box is different from completing a normal CAPTCHA.
And then look at whether your technical controls would notice if somebody ignored that advice anyway.
Because that’s the more useful question:
If somebody in your organisation fell for TerminalFix tomorrow, how far could the attacker get?
That’s a much better measure of your security than simply asking whether everyone has completed their annual cyber awareness training.
Source: Microsoft’s TerminalFix research, reported by BleepingComputer.
