- The Mess: Microsoft found a ClickFix campaign that tricks victims into running PowerShell through a fake Cloudflare CAPTCHA. The payload then installs a multi-stage backdoor instead of the usual commodity stealer.
- The Damage: Attackers get an encrypted tunnel into the victim’s network and can use the compromised Windows host to reach internal systems.
- The Fix: Block suspicious PowerShell execution, investigate fake-CAPTCHA infections and hunt for the TerminalFix payload chain.
The CAPTCHA isn’t checking whether you’re human.
It’s checking whether you’ll execute PowerShell for the attacker.
Microsoft’s researchers identified a campaign they call TerminalFix, a variation of ClickFix that pushes victims toward Windows Terminal or PowerShell instead of the Windows Run dialog.
The change matters.
Windows Terminal handles complex, multi-line commands much better than the old Run box. That gives attackers more room to deploy a real infection chain.
The Fake CAPTCHA Does the Social Engineering
The attack begins on a compromised website.
The victim sees an overlay pretending to be a Cloudflare verification page.
Instead of completing a normal CAPTCHA, the victim is instructed to copy a command and execute it in Windows Terminal or PowerShell.
The command is the actual infection mechanism.
No browser exploit is required.
No vulnerability in Cloudflare is required.
The victim becomes the execution primitive.
Then the DLL Takes Over
TerminalFix does not stop at a simple PowerShell downloader.
Microsoft observed a multi-stage chain involving a legitimate executable and a malicious DLL.
The DLL is loaded through DLL side-loading, allowing the attacker-controlled code to execute under the context of a legitimate binary.
The chain ultimately deploys a Python-based implant.
That implant establishes an encrypted WebSocket connection back to the attackers.
The result is effectively a remote tunnel into the compromised machine.
The Backdoor Wants the Network
This is where TerminalFix becomes more interesting than another ClickFix infostealer.
The implant can provide a SOCKS5-style proxy.
That gives the attacker a way to use the infected Windows machine as a bridge toward internal infrastructure.
Microsoft says the operators can probe internal resources, including domain controllers, and execute commands through the established access path.
A workstation behind the corporate firewall suddenly becomes an attacker-controlled network foothold.
The Internet-facing perimeter didn’t fail.
The user opened the door from the inside.
ClickFix Has Changed
Traditional ClickFix campaigns often end with an infostealer or relatively simple malware loader.
TerminalFix shows a more ambitious direction.
The social-engineering trick remains almost embarrassingly simple:
“Copy this command to verify that you are human.”
The payload behind it is anything but simple.
Microsoft observed a chain combining:
- compromised websites;
- fake CAPTCHA overlays;
- PowerShell;
- Windows Terminal;
- DLL side-loading;
- Python;
- encrypted WebSockets;
- internal network tunneling.
The initial step is cheap.
The post-compromise capability is much more expensive.
What Defenders Should Hunt
Security teams should investigate endpoints where users recently executed PowerShell commands copied from browser pages.
Look for:
- suspicious PowerShell spawned from browsers;
- recently dropped DLLs and executables;
- unusual DLL side-loading;
- Python processes appearing on machines that normally don’t use Python;
- outbound WebSocket connections from workstations;
- unexpected SOCKS/proxy behaviour;
- connections from user workstations toward domain controllers or other internal infrastructure.
A fake CAPTCHA should never require PowerShell.
That’s an easy rule to communicate to users.
Bugstoday Opinion
ClickFix was already a nasty social-engineering trick.
TerminalFix turns it into something more useful for an attacker: initial access followed by internal network access.
The technical lesson is simple. A user pasting a command into Terminal is not “following a CAPTCHA.” They’re executing code with the privileges of their account.
Once the payload installs a tunnel, the compromised PC stops being the final target.
It becomes the attacker’s router.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security — TerminalFix campaign analysis
Microsoft Threat Intelligence — ClickFix and TerminalFix research
Windows Terminal / PowerShell — Microsoft documentation
