Microsoft reported a real-world campaign (“TerminalFix”) where attackers use compromised websites to show a fake Cloudflare CAPTCHA. The prompt tricks visitors into copying and running a malicious PowerShell/Terminal command, which then installs a reverse-tunnel backdoor that can give attackers ongoing access into the victim’s internal network.
The TerminalFix campaign begins on compromised websites rather than through email or messaging. Visitors are shown a fake Cloudflare CAPTCHA verification page that looks like a routine human-verification step. Instead of clicking a checkbox, the page instructs users to copy a command and paste it into Windows Terminal or PowerShell to "verify" they are human. This copy/paste pattern is a ClickFix-style workflow, and directing users specifically to Terminal or PowerShell increases the chance that longer, multi-line scripts execute successfully.
Once run, the command downloads a ZIP archive containing a legitimate executable paired with a malicious DLL, a technique known as DLL sideloading. Later stages retrieve hidden payloads embedded in PNG images hosted on external domains, ultimately deploying a custom reverse-tunnel implant on the victim machine.
The attack relies on a familiar, low-friction interaction. CAPTCHA prompts are common and generally trusted, so a fake verification screen on a compromised site does not immediately raise suspicion. By asking users to run a command rather than click a button, attackers move the action outside the browser sandbox and into a full-privilege command shell, where security tooling may have less visibility. The use of a legitimate EXE alongside a malicious DLL also helps the payload blend in during execution.
Organizations should train all employees, IT helpdesk staff, and Windows administrators that legitimate CAPTCHA checks never require running commands in PowerShell or Terminal. Staff should be encouraged to stop and report any page that asks them to copy and execute commands rather than attempt it themselves, since these prompts should be treated as likely malicious by default.
Security teams should also emphasize the business impact of this attack pattern: a single infected workstation can become a gateway into the internal network through the reverse tunnel, potentially enabling further actions such as privilege escalation, data theft, or ransomware. Building this awareness across all roles, not just technical staff, reduces the chance that a single compromised browsing session turns into a broader network intrusion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TerminalFix is a real-world campaign where compromised websites display a fake Cloudflare CAPTCHA that instructs visitors to copy and run a malicious PowerShell command, which then installs a reverse-tunnel backdoor.
No. Legitimate CAPTCHA verification never requires copying and executing commands in PowerShell or Windows Terminal, so any prompt asking for this should be treated as a red flag.
It gives attackers direct, ongoing access into the victim's internal network, which can enable further actions like privilege escalation, data theft, or ransomware.
They should stop, avoid running the command, and report the page to their security team, since copy/paste command instructions on ordinary websites are a strong indicator of a ClickFix-style attack.
You land on a normal website, and suddenly a Cloudflare page pops up: “Verify you are human.” But this one is different. Under the fake Cloudflare logo it says: “Copy the command below and run it in Windows Terminal or PowerShell to continue.” That’s the TerminalFix trick. If you paste that, it quietly pulls a ZIP, sideloads a malicious DLL, then hides a reverse-tunnel backdoor inside PNG files, turning your one PC into a doorway into our whole network. Aha to remember: real CAPTCHAs never make you run PowerShell. If any webpage tells you to copy commands into Terminal, stop and report it to security immediately.
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
Ukraine’s CERT says the Russia-linked Sandworm group is tricking targets into infecting their own PCs using compromised websites that display fake CAPTCHA checks. Victims are instructed to copy and paste a PowerShell command, which downloads malware and can lead to deeper compromise. CERT also…
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
