TerminalFix turns a fake CAPTCHA into persistent network access

Microsoft described a TerminalFix campaign using compromised sites to display fake Cloudflare verification prompts. Instead of completing a browser challenge, the user was directed to run a command through Windows Terminal or PowerShell. The August account attributes the subsequent execution to that social-engineering step.

Researchers reported a staged chain involving signed applications, concealed payloads, persistence and a reverse-tunnel component. That final access could expose traffic through the affected host, extending the impact beyond the initial browser page. The report concerns an impersonation of Cloudflare branding, not a legitimate requirement from its verification service. A browser check that asks the visitor to execute commands on the device changes the security boundary substantially.