{"id":36714,"date":"2026-09-05T21:05:56","date_gmt":"2026-09-05T21:05:56","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/en\/?p=36714"},"modified":"2026-09-08T21:09:23","modified_gmt":"2026-09-08T21:09:23","slug":"fake-captchas-are-now-aiming-for-your-terminal-inside-the-terminalfix-campaign","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/fake-captchas-are-now-aiming-for-your-terminal-inside-the-terminalfix-campaign","title":{"rendered":"Fake CAPTCHAs Are Now Aiming for Your Terminal: Inside the TerminalFix Campaign"},"content":{"rendered":"\n

Fake CAPTCHA pages that ask you to “verify you are human” by copying a command into a dialog box have become a common way for attackers to get malware onto corporate networks. The victim runs the command themselves, which sidesteps a lot of the tooling that would normally catch a malicious download.<\/p>\n\n\n\n

Microsoft Threat Intelligence recently detailed a campaign that extends this approach. Named TerminalFix<\/a>, it directs victims to Windows Terminal or PowerShell rather than the usual Windows Run dialog, which lets attackers run longer, more complex scripts than a single Run command allows. The result is not a lone infostealer but a multi-stage intrusion that ends with a hidden tunnel into the victim’s internal network.<\/p>\n\n\n\n

For organizations still treating fake verification pages as a minor nuisance, TerminalFix is a reason to reconsider. One pasted command can give an attacker a foothold that reaches domain controllers, backup servers, and mail systems.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The move to Windows Terminal<\/h2>\n\n\n\n

TerminalFix builds on ClickFix<\/a>, the social engineering technique that spread widely through 2024 and 2025. ClickFix uses a fake error or verification message to trick the victim into copying and running a malicious command, and it has worked well for attackers. Infosecurity Magazine reported the technique surged 517% in early 2025<\/a>, making it the second most common attack vector after phishing.<\/p>\n\n\n\n

The appeal for attackers is that the user infects themselves. No malicious attachment lands in an inbox, and no obvious download triggers a scanner. The payload comes from the victim’s own clipboard, which avoids much of the automated tooling organizations depend on.<\/p>\n\n\n\n

TerminalFix keeps that model and raises the stakes. Pointing people to Windows Terminal or PowerShell instead of the Run box gives attackers room for multi-line scripts that download files, set up persistence, run reconnaissance, and connect back to their infrastructure in one sequence. Microsoft observed the campaign hitting organizations across several industries, using compromised legitimate websites to serve the lure.<\/p>\n\n\n\n

How the Attack Unfolds<\/h2>\n\n\n\n

The chain starts on a compromised website that briefly shows its real content before a fake Cloudflare Turnstile overlay takes over, with the logo, a “Verify you are human” checkbox, and a loading spinner. When the visitor interacts with it, a PowerShell command is copied to their clipboard, and on-screen instructions walk them through pasting it into their terminal.<\/p>\n\n\n\n

Once run, the command prints reassuring Cloudflare-themed messages while it downloads a ZIP archive containing a legitimate signed Windows binary (LockScreenContentServer.exe) and a malicious DLL. The signed file loads the malicious DLL, a technique called DLL sideloading that lets the attacker operate inside a trusted process and avoid controls that watch for suspicious program names.<\/p>\n\n\n\n

From there the campaign gets stealthier. Later payloads are hidden inside PNG images using steganography, extracted from the pixel data, and reassembled on disk. The malware sets up two independent forms of persistence, then maps out the environment. The reconnaissance it performs is the part that should concern IT teams:<\/p>\n\n\n\n