Microsoft warns of TerminalFix malware campaign using fake CAPTCHA prompts

Microsoft has identified a new malware campaign that weaponizes one of the internet's most familiar security rituals: the CAPTCHA prompt. The campaign, called TerminalFix, tricks Windows users into believing they need to verify their humanity by opening PowerShell or Command Prompt and pasting in a command. The fake verification pages impersonate Cloudflare and other trusted services, lending them just enough credibility to bypass the skepticism most people have learned to apply to suspicious websites.

This is not a novel attack in isolation. TerminalFix is a refinement of earlier campaigns known as ClickFix, which have circulated among business users for some time. The original ClickFix attacks directed victims to the Windows Run dialog to execute commands that would install information stealers. TerminalFix makes a crucial change: by routing users through PowerShell or Command Prompt instead, attackers gain the ability to execute longer, multi-line scripts. Microsoft's threat intelligence team noted that this shift materially increases the likelihood that complex commands will run successfully, giving attackers more flexibility in what they can accomplish once a machine is compromised.

The real danger emerges after the initial infection. When a user runs the malicious command, TerminalFix initiates a multi-stage intrusion that can grant the attacker persistent proxy access through the compromised machine. That foothold becomes a potential gateway into other parts of a company's network. An attacker with access to an unsecured network could use the initially infected system to steal data, spread malware to other devices, or install ransomware. The scope of damage depends on the victim's network controls, endpoint security, and user permissions—but the initial breach often comes down to a single person following instructions they believed came from a legitimate service.

What makes TerminalFix particularly effective is that it relies entirely on social engineering rather than hidden software exploits. There is no zero-day vulnerability to patch, no obscure technical flaw to close. The attacker simply needs the user to follow the instructions on the fake verification page. This places employee awareness squarely on the front line of defense. A CAPTCHA that asks someone to open PowerShell, Command Prompt, or the Windows Run dialog should trigger immediate suspicion. Legitimate CAPTCHA services do not require users to run system commands to prove they are human. That request is, by definition, abnormal.

Microsoft has published mitigation guidance for organizations. The recommendations include restricting access to PowerShell and the Windows Run dialog where possible, monitoring systems for signs of DLL sideloading, blocking Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. These controls come with practical constraints. IT administrators, developers, and other technical users often need access to scripting tools as part of their daily work. Companies can still reduce risk by limiting those tools to users who actually need them and monitoring for unusual command activity that might signal a compromise.

Security teams should also conduct an inventory of older software still installed across their environments. Microsoft's recommendation to block Flash plugins illustrates a broader principle: outdated components that are no longer needed for work can still create additional paths for attackers. The campaign is primarily a concern for enterprise networks, where one compromised device can provide a path to more valuable systems and data. But the basic principle applies to individual users as well. Do not run a PowerShell or Command Prompt command simply because a website asks you to, especially when the request is framed as a CAPTCHA or security check. The moment someone asks you to open a terminal to verify you are human, you are no longer dealing with a legitimate security measure.