TerminalFix Variant Exploits Fake CAPTCHAs to Deploy Backdoor

Microsoft has identified a new social engineering variant called TerminalFix that uses fraudulent Cloudflare CAPTCHA prompts to trick users into executing malicious commands. The campaign represents an evolution of the ClickFix technique, redirecting victims to Windows Terminal or PowerShell rather than the Windows Run dialog.

The shift to terminal interfaces increases the likelihood that victims will execute complex, multi-line commands without scrutiny. Traditional ClickFix campaigns relied on the Run dialog's limited interface; TerminalFix exploits the greater flexibility of modern command-line tools to deploy more sophisticated payloads.

The attack deploys a reverse-tunnel backdoor, granting attackers persistent remote access to compromised systems. By masquerading as legitimate Cloudflare security checks, the campaign exploits user trust in widely recognized brand infrastructure. The fake CAPTCHA pages appear during routine browsing, lowering victim suspicion.

• 01IT security teams must update CAPTCHA verification training and terminal execution policies
• 02Enterprises face increased risk from social engineering targeting command-line interfaces
• 03Cloudflare brand exploitation may erode user trust in legitimate security prompts