Listen to the episode
TLDR
Microsoft Threat Intelligence has documented a new variant of the ClickFix social engineering technique dubbed TerminalFix . Attackers compromise legitimate websites and display a fake Cloudflare Turnstile CAPTCHA overlay. Victims are...
How it works
Microsoft Threat Intelligence has documented a new variant of the ClickFix social engineering technique dubbed TerminalFix . Attackers compromise legitimate websites and display a fake Cloudflare Turnstile CAPTCHA overlay. Victims are...
Red flags
- A website shows a CAPTCHA that asks you to open Terminal/PowerShell and paste a command. Instructions claim verification requires running code on your machine. Unexpected processes (e.g., LockScreenContentServer.exe) or hidden folders appear in C:\ProgramData
What to do
- 1Never paste commands from web prompts into PowerShell or Terminal
- 2real CAPTCHAs do not require this. Block and report the page
- 3clear browser clipboard access for untrusted sites. If executed, isolate the device, rotate credentials, and
Source
microsoft-security
Source reviewed by Mythos Forensic Team
https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/FAQ
Is TerminalFix Campaign: Fake Cloudflare CAPTCHA Tricks Users Into Running Malicious PowerShell Commands a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
A website shows a CAPTCHA that asks you to open Terminal/PowerShell and paste a command. Instructions claim verification requires running code on your machine. Unexpected processes (e.g., LockScreenContentServer.exe) or hidden folders appear in C:\ProgramData
What should I do first?
Never paste commands from web prompts into PowerShell or Terminal; real CAPTCHAs do not require this. Block and report the page; clear browser clipboard access for untrusted sites. If executed, isolate the device, rotate credentials, and
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.