Microsoft reports a real malware campaign (“TerminalFix”) that uses a fake Cloudflare CAPTCHA to trick people into running a malicious command copied to their clipboard. Victims are told to paste the command into Run/PowerShell to “prove they are human,” which starts a multi-stage infection. The end goal is a hidden reverse tunnel that can give attackers remote access into the victim’s network through encrypted traffic over port 443.
TerminalFix is a malware campaign reported by Microsoft that disguises itself as a routine Cloudflare CAPTCHA check. When a visitor clicks the fake verification box, a malicious command is secretly copied to their clipboard without any visible action on the page. The site then tells the visitor to paste and execute that command in Run, Terminal, Command Prompt, or PowerShell to 'prove they are human.' In reality, running that command kicks off a multi-stage infection chain.
Once executed, the malware retrieves payloads hidden inside PNG image files and reconstructs executables and DLLs directly on the victim's disk. The end result is a custom multiplexed reverse TCP tunnel, a hidden remote-access pathway into the victim's network that communicates over encrypted traffic on port 443, making it harder to distinguish from normal web activity.
This technique works because it borrows the visual language of a familiar, trusted interaction, the CAPTCHA, and repurposes it to push a technical action that most people would never think to question. Non-technical staff in particular may not recognize that a genuine CAPTCHA never requires opening a system terminal or pasting a command. The instructions frame the action as necessary to complete a normal task, lowering suspicion at the exact moment a red flag should appear.
Sophisticated versions of this style of attack add countdowns, user counters, or other pressure tactics designed to push people into acting before they think it through. Attackers rely on urgency to discourage careful thought, which is precisely what allows a fake verification step to slip past someone's usual caution.
Organizations can reduce the risk of this style of attack by reinforcing a few concrete habits across all employees, not just technical staff:
Because TerminalFix targets Windows endpoints across any organization, awareness training and helpdesk reporting channels both play a role in catching this pattern early, before a pasted command turns into a persistent remote-access foothold.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TerminalFix is a malware campaign identified by Microsoft that uses a fake Cloudflare CAPTCHA to trick victims into copying and running a malicious command, which starts a multi-stage infection.
When a visitor clicks the fake CAPTCHA, a malicious command is secretly copied to their clipboard, and the page instructs them to paste and run it in Run, Terminal, or PowerShell to 'prove they are human.'
The malware retrieves payloads hidden inside PNG images, reconstructs executables and DLLs on disk, and ultimately builds a custom multiplexed reverse TCP tunnel giving attackers hidden remote access over port 443.
A real CAPTCHA asks users to click boxes or select images, it will never instruct someone to open Run, Terminal, Command Prompt, or PowerShell and paste a command.
You click a Cloudflare CAPTCHA, and suddenly a page says: “To prove you are human, paste this command into PowerShell.” This is TerminalFix malware. That fake Cloudflare CAPTCHA secretly copied a command to your clipboard and tells you to run it in Run or PowerShell, which kicks off a multi‑stage infection and builds a hidden reverse TCP tunnel over port 443. Here’s the giveaway: real CAPTCHAs might ask you to click boxes or pick traffic lights, but they will never tell you to open Run, Command Prompt, Terminal, or PowerShell and paste a command from your clipboard. If any webpage or CAPTCHA tells you to paste or run a command, stop right there and close the page, do not run the command.
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
