A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the organization.
TerminalFix is a ClickFix-style social engineering attack that relies on compromised websites rather than malicious links or attachments. When a visitor lands on one of these sites, they are shown what looks like a routine Cloudflare CAPTCHA verification screen. Instead of clicking a checkbox, the visitor is instructed to copy a command and paste it into Windows Terminal or PowerShell to prove they are human. Running that command can trigger follow-on malware activity and give attackers persistent access to the victim's system.
This approach shifts the burden of execution onto the user. Rather than delivering a malicious file directly, the attacker convinces the target to manually run the payload themselves, which can bypass some of the usual suspicion tied to unexpected downloads or attachments.
The lure works because CAPTCHA verification is a familiar, low-friction interaction that most users have completed countless times without a second thought. By dressing the prompt up as a trusted brand check, the attack borrows credibility from a recognizable security control. The instructions to open Windows Terminal or PowerShell and paste a command add a layer of technical legitimacy that can make the request feel like a normal troubleshooting step rather than a red flag.
Organizations can reduce the risk of this attack pattern with a few consistent habits:
This technique spans multiple sectors, including critical infrastructure, and applies broadly across roles such as Finance, HR, Operations, and IT, with added emphasis for users who hold admin rights or staff on the helpdesk and security operations teams who may be asked to help troubleshoot the "verification" step.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TerminalFix is a ClickFix-style social engineering attack that convinces users to run a command rather than click a traditional malicious link. It's delivered through compromised websites that show a fake Cloudflare CAPTCHA verification step.
A compromised website displays a fake Cloudflare CAPTCHA verification and instructs the visitor to copy and paste a PowerShell command into Windows Terminal or PowerShell to prove they are human, enabling follow-on malware activity and persistence.
A real CAPTCHA never requires running PowerShell or Terminal commands. Any unexpected verification step asking you to copy and execute code on a site you were simply browsing is a red flag.
The scenario targets all employees across roles including Finance, HR, Operations, and IT, with particular relevance to users with admin rights, helpdesk staff, and security operations teams.
You open a normal website and suddenly see: “Cloudflare verification required: run this PowerShell command to continue.” This is TerminalFix, a ClickFix-style scam. Compromised sites show a fake Cloudflare CAPTCHA and tell you to paste a PowerShell command into Windows Terminal or PowerShell so you can ‘prove you’re human.’ Here’s the trick: real CAPTCHAs ask you to click boxes or pick pictures. They never tell you to run code. If a site you’re just browsing suddenly wants a PowerShell or Terminal command, that’s your red alert. If any “verification” tells you to copy and run a command, stop. Don’t run it, screenshot it and report it to IT right away.
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
Attackers abused real ChatGPT “Custom GPT” pages and a fake Cloudflare CAPTCHA to trick users into copying and pasting a PowerShell command on Windows. That command installed a malicious MSI and led to a multi-stage infection ending in a remote access trojan (RAT) with deep control of the victim’s…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
