The takeaway: Microsoft has identified a new malware campaign that uses fake CAPTCHA prompts to trick Windows users into running malicious commands. The campaign, called TerminalFix, is a variation of the ClickFix attacks that have become increasingly common among business users. The campaign highlights a broader security problem: familiar browser prompts can now bypass technical safeguards by convincing users to execute the attacker’s code themselves.
Understanding TerminalFix
The deceptive pages impersonate reputable services like Cloudflare, presenting users with a façade of legitimacy. Instead of the typical CAPTCHA challenge, these pages instruct users to open PowerShell or Command Prompt and paste in a command. This marks a significant shift from previous ClickFix activities, which often directed victims to the Windows Run dialog to install information-stealing malware. TerminalFix, however, leverages PowerShell or Command Prompt, allowing attackers to execute more complex, multi-line scripts with greater ease.
According to Microsoft, this evolution in tactics increases “the likelihood that complex, multi-line scripts execute successfully,” thereby enhancing the potential impact of the attack.
The Multi-Stage Intrusion
TerminalFix is not merely designed to compromise a single device; it initiates a multi-stage intrusion that grants attackers persistent proxy access through the infected machine. This access can serve as a gateway into other segments of a company’s network, posing a significant risk. An attacker who gains entry into an unsecured network can exploit the compromised system to steal sensitive data, propagate malware to additional devices, or deploy ransomware. The extent of the damage inflicted will largely depend on the victim’s network controls, endpoint security measures, and user permissions.
The Role of Social Engineering
Unlike traditional malware that relies on hidden software exploits, TerminalFix capitalizes on social engineering tactics. The attacker relies on the user to comply with the instructions presented on the counterfeit verification page, underscoring the importance of employee awareness as a critical line of defense. Any CAPTCHA that requests the execution of PowerShell, Command Prompt, or the Windows Run dialog should be regarded with skepticism, as legitimate CAPTCHA services do not require users to run system commands to verify their humanity.
Mitigation Strategies
In response to this emerging threat, Microsoft Threat Intelligence has released mitigation guidance for organizations. Key recommendations include:
- Restricting access to PowerShell and the Windows Run dialog whenever feasible.
- Monitoring systems for indicators of DLL sideloading.
- Blocking outdated Flash plugins.
- Enabling cloud-delivered protection in Microsoft Defender Antivirus.
While these controls may not be suitable for every employee or device, IT administrators, developers, and other technical personnel may require access to scripting tools as part of their roles. Companies can still mitigate risk by limiting access to these tools to essential users and closely monitoring for any unusual command activity.
Security teams should also conduct a thorough review of older software present in their environments. Microsoft’s recommendation to block Flash plugins serves as a reminder that outdated components can create additional vulnerabilities for attackers, even when they are no longer necessary for daily operations.
While the TerminalFix campaign primarily poses a threat to enterprise networks—where a single compromised device can lead to access to more valuable systems and data—the fundamental advice holds true for individual users as well. It is crucial to refrain from executing any PowerShell or Command Prompt commands simply because a website requests it, particularly when such requests are framed as CAPTCHAs or security verifications.
