Attackers Abuse Fake Cloudflare CAPTCHA to Gain Network Access

Threat Overview

A new ClickFix-style campaign dubbed TerminalFix is using fake Cloudflare CAPTCHA pages to trick users into executing malicious PowerShell commands.

The campaign begins on compromised websites, where victims are presented with a convincing “Verify you are human” Cloudflare Turnstile prompt. Instead of completing a CAPTCHA, interacting with the page copies a malicious command to the clipboard and instructs the user to paste it into Windows Terminal or PowerShell.

Unlike typical ClickFix campaigns that primarily deliver information stealers, TerminalFix establishes a persistent reverse tunnel, potentially allowing attackers to use the compromised device as a gateway into the organization's internal network.

Attack Methodology

Why It Matters

A single social-engineering interaction can turn an employee's workstation into a network pivot point. Once the reverse tunnel is established, attackers can potentially reach internal systems from the compromised endpoint without exposing those systems directly to the internet.

The campaign demonstrates how ClickFix is evolving. Instead of simply delivering a stealer, attackers are combining social engineering, legitimate signed binaries, DLL sideloading, hidden payloads and network tunnelling to establish deeper access.

Recommendations

Organizations should:

• Train users to never paste commands into PowerShell or Windows Terminal based on instructions from a website.

• Monitor for suspicious PowerShell execution and unusual command-line activity.

• Enable PowerShell Script Block Logging and endpoint detection.

• Monitor for DLL sideloading involving legitimate Windows binaries.

• Investigate unexpected Registry Run keys and scheduled tasks.

• Monitor outbound connections from endpoints to unfamiliar infrastructure, particularly unusual WebSocket or encrypted traffic.

• Hunt for unexpected Active Directory enumeration and internal network scanning.

• Restrict PowerShell and command execution for standard users where operationally feasible.

‍