Microsoft Warns of TerminalFix Attacks Using Fake CAPTCHAs to Execute Malicious PowerShell Commands

Microsoft researchers have discovered a new type of attack called TerminalFix that uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal.

The campaign, which is a variant of ClickFix attacks, uses a multi-stage intrusion chain to gain access to the victim's internal network. Unlike typical ClickFix attacks, TerminalFix directs users to execute PowerShell commands, enabling the execution of more complex scripts.

According to Microsoft, the infection begins with a fake CAPTCHA prompt that instructs victims to execute a preloaded PowerShell command. This command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory.

The malware establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour. It also performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory (AD).