We have all clicked the little “verify you are human” box without a second thought. Microsoft’s threat researchers have documented a campaign, dubbed TerminalFix, that turns that reflex into a weapon. It is a slicker cousin of a technique called ClickFix, and its whole trick is convincing you to run the malware yourself, no exploit required.
It starts on a hacked website showing a convincing fake of Cloudflare’s familiar “Verify you are human” widget. When you interact with it, the page quietly copies a command to your clipboard and tells you to paste it into Windows Terminal to “complete verification.” That small change is the clever part. Older versions of this scam pointed victims at the Windows Run box; steering them into a full terminal instead means longer, multi-line scripts run cleanly. Paste it, and a wall of reassuring, color-coded “Cloudflare verification” messages scrolls by while, underneath, the real work begins.
A masterclass in hiding
What happens next reads like a checklist of evasion tricks. The command pulls down a ZIP containing a legitimate, Microsoft-signed Windows program alongside a malicious file with the same name a real system library would use. Because Windows loads files from a program’s own folder before the trusted system folder, the fake library loads first, and the malicious code ends up running inside a signed Microsoft process. To any security tool judging software by its reputation, it looks like Windows being Windows.
From there it gets stranger. The next payloads are not downloaded as programs at all; they are hidden inside ordinary PNG images, tucked into the pixels through steganography, then reassembled on the machine and the source images deleted. The malware buries itself in a hidden system folder, sets up two separate ways to relaunch itself, and relaunches every hour. Almost nothing about it looks like a conventional download or executable in transit, which is precisely the point.
Not a thief, a doorway
Here is what makes TerminalFix truly worrying, and it is not the usual stealing of passwords. Once settled in, it maps out the network, hunting for domain controllers, databases, backup servers, and mail systems, then quietly turns the infected PC into a tunnel. Using a hidden Python component that phones home over an encrypted connection disguised as normal web traffic, it lets a remote operator route their own connections through your machine to reach systems deep inside the corporate network. In effect, one person pasting one command can hand attackers a foothold behind the firewall.
Notably, Microsoft did not see any ransomware, credential theft, or lateral movement in the cases it analysed. That sounds reassuring but probably is not. A tool this focused on stealth and access looks like the setup phase, the quiet establishing of a doorway that gets used, or sold, later, and Microsoft itself notes the hands-on-keyboard attack usually comes next. Affected machines should be treated as live pivot points, not tidy cleanups.
The defenses are a mix of the technical and the human. Security teams can hunt for the tell-tale signs, that signed lock-screen binary running from the wrong folder, hidden directories, hourly scheduled tasks, and odd Python activity, and tighten PowerShell and application controls. But the single most useful thing anyone can teach staff is almost embarrassingly simple. A real CAPTCHA will never, ever ask you to paste a command into a terminal. So the next time a website does, what should you do? Close the tab. That is the entire defense.
This website uses cookies.