Microsoft warns of a real malware campaign (“TerminalFix”) that uses fake CAPTCHA pages to convince people to open PowerShell or Command Prompt and paste attacker-provided commands. Because the user runs the command themselves, the attack can bypass many technical safeguards and can lead to deeper access into a company network.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a site, see a Cloudflare-style CAPTCHA, and it says: "Verify you are human: open PowerShell and paste this command." This is a real attack called TerminalFix. The page impersonates Cloudflare, skips the normal image puzzle, and walks you step by step to open PowerShell or Command Prompt and run their code. Here’s the nasty part: because you paste it yourself, it can slip past some defenses, then quietly turn your laptop into a proxy into our network, paving the way for ransomware. Remember this rule: if any CAPTCHA or security check tells you to open PowerShell, Command Prompt, or Run and paste a command, stop and report it to IT immediately.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Attackers compromised over 100 legitimate websites and showed visitors in Ukraine a fake Cloudflare verification page. The page instructed users to copy and run a PowerShell command, which instead installed Lunex Stealer to steal passwords, tokens, and crypto wallet data and enable remote access.…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
