Microsoft Reveals New ClickFix Variant Using Fake Cloudflare CAPTCHA

Microsoft has announced details of a new ClickFix variant named TerminalFix. Unlike traditional ClickFix campaigns that lure victims into Windows’ Run dialog, TerminalFix directs users straight to Windows Terminal or PowerShell, increasing the likelihood that complex malicious code will be executed¹.

The attack hinges on a counterfeit Cloudflare CAPTCHA interface. When a user clicks “Verify,” the page silently launches a PowerShell command rather than presenting an actual challenge. The deceptive UI mimics Cloudflare’s familiar “I’m not a robot” prompt, exploiting users’ trust in legitimate services¹.

Once the command runs, it establishes a reverse tunnel—most likely using tools such as Ngrok or similar SSH tunnels—to give attackers long-term access even if firewalls block outbound connections on nonstandard ports. This persistence mirrors tactics previously employed by APT28 (Fancy Bear) against Ukrainian targets between 2016 and 2017 for command & control while masking their true location behind a proxy server.

Because the exploit uses Windows Terminal—a native system component—it more closely resembles standard behavior than direct manipulation of the Run dialog would allow. Attackers can therefore bypass many basic detection heuristics that flag unusual terminal activity.

Users are advised to verify any unexpected PowerShell commands with digital signatures from trusted publishers before execution. The key vulnerability is not the operating system itself but human reliance on visual cues without process integrity checks.

Similar campaigns have appeared earlier this year targeting financial institutions via phishing emails containing malicious links disguised as invoice attachments. Those attacks also leveraged decoy login pages to run background code, underscoring how the technique evolves rather than disappears.

The implications for privacy and computer security are significant. Organizations should audit terminal usage logs, enforce least privilege policies, and educate staff about deceptive CAPTCHAs. Updating endpoint protection to detect anomalous PowerShell invocations will help mitigate future incidents.

Microsoft’s disclosure shows an emerging threat vector that blends social engineering with sophisticated tunneling, reminding users that even familiar interfaces can conceal dangerous instructions.