Microsoft warns of a real malware campaign (“TerminalFix”) that uses fake CAPTCHA pages to convince people to open PowerShell or Command Prompt and paste attacker-provided commands. Because the user runs the command themselves, the attack can bypass many technical safeguards and can lead to deeper access into a company network.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a site, see a Cloudflare-style CAPTCHA, and it says: "Verify you are human: open PowerShell and paste this command." This is a real attack called TerminalFix. The page impersonates Cloudflare, skips the normal image puzzle, and walks you step by step to open PowerShell or Command Prompt and run their code. Here’s the nasty part: because you paste it yourself, it can slip past some defenses, then quietly turn your laptop into a proxy into our network, paving the way for ransomware. Remember this rule: if any CAPTCHA or security check tells you to open PowerShell, Command Prompt, or Run and paste a command, stop and report it to IT immediately.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
