A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the organization.
TerminalFix is a ClickFix-style social engineering attack that relies on compromised websites rather than malicious links or attachments. When a visitor lands on one of these sites, they are shown what looks like a routine Cloudflare CAPTCHA verification screen. Instead of clicking a checkbox, the visitor is instructed to copy a command and paste it into Windows Terminal or PowerShell to prove they are human. Running that command can trigger follow-on malware activity and give attackers persistent access to the victim's system.
This approach shifts the burden of execution onto the user. Rather than delivering a malicious file directly, the attacker convinces the target to manually run the payload themselves, which can bypass some of the usual suspicion tied to unexpected downloads or attachments.
The lure works because CAPTCHA verification is a familiar, low-friction interaction that most users have completed countless times without a second thought. By dressing the prompt up as a trusted brand check, the attack borrows credibility from a recognizable security control. The instructions to open Windows Terminal or PowerShell and paste a command add a layer of technical legitimacy that can make the request feel like a normal troubleshooting step rather than a red flag.
Organizations can reduce the risk of this attack pattern with a few consistent habits:
This technique spans multiple sectors, including critical infrastructure, and applies broadly across roles such as Finance, HR, Operations, and IT, with added emphasis for users who hold admin rights or staff on the helpdesk and security operations teams who may be asked to help troubleshoot the "verification" step.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TerminalFix is a ClickFix-style social engineering attack that convinces users to run a command rather than click a traditional malicious link. It's delivered through compromised websites that show a fake Cloudflare CAPTCHA verification step.
A compromised website displays a fake Cloudflare CAPTCHA verification and instructs the visitor to copy and paste a PowerShell command into Windows Terminal or PowerShell to prove they are human, enabling follow-on malware activity and persistence.
A real CAPTCHA never requires running PowerShell or Terminal commands. Any unexpected verification step asking you to copy and execute code on a site you were simply browsing is a red flag.
The scenario targets all employees across roles including Finance, HR, Operations, and IT, with particular relevance to users with admin rights, helpdesk staff, and security operations teams.
You open a normal website and suddenly see: “Cloudflare verification required: run this PowerShell command to continue.” This is TerminalFix, a ClickFix-style scam. Compromised sites show a fake Cloudflare CAPTCHA and tell you to paste a PowerShell command into Windows Terminal or PowerShell so you can ‘prove you’re human.’ Here’s the trick: real CAPTCHAs ask you to click boxes or pick pictures. They never tell you to run code. If a site you’re just browsing suddenly wants a PowerShell or Terminal command, that’s your red alert. If any “verification” tells you to copy and run a command, stop. Don’t run it, screenshot it and report it to IT right away.
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
A voicemail-themed phishing campaign (“Kali365 Ringer”) targeted financial and insurance organizations using a missed-call notification and a Google Sites page to appear legitimate. Victims were redirected through multiple trusted services and instructed to approve a Microsoft device-code login…
