TerminalFix ClickFix Variant (Fake Cloudflare CAPTCHA Reverse-Tunnel Backdoor)
First seen Aug 31, 2026 · Updated Aug 31, 2026
Microsoft disclosed a new ClickFix-style social engineering campaign, dubbed TerminalFix, that uses fraudulent Cloudflare CAPTCHA pages to trick users into executing malicious commands in Windows Terminal or PowerShell instead of the traditional Run dialog. Successful execution deploys a reverse-tunnel backdoor granting attackers persistent remote access to the compromised host. This shift to terminal-based execution increases the likelihood that victims run more complex, capability-rich payloads compared to earlier ClickFix variants.
Technical Analysis
TerminalFix follows the established ClickFix pattern of presenting a fake verification page (impersonating Cloudflare CAPTCHA) that instructs the user to copy and paste a command, but redirects the target execution surface to Windows Terminal or PowerShell rather than the Run dialog, enabling longer and more sophisticated one-line payloads. The delivered payload establishes a reverse tunnel, giving attackers outbound-initiated, firewall-evading remote access and a foothold for follow-on backdoor deployment, credential harvesting, and lateral movement. No CVE is associated with this technique since it relies entirely on social engineering rather than a software vulnerability; detection depends on monitoring for anomalous clipboard-to-terminal execution chains and unusual outbound tunneling connections. Any host compromised via this technique that also runs AI agent frameworks, LLM orchestration tools, or holds API keys/secrets for RAG pipelines is at risk of credential theft, exfiltration of agent configuration/tool-access tokens, and potential hijacking of agent execution environments through the attacker's persistent shell access, making this technique agent-relevant for organizations that run developer or automation workstations hosting agent tooling.
Affected Systems
Windows systems where users have access to Windows Terminal or PowerShell; developer and IT admin workstations are especially high-risk given routine terminal use
Indicators of Compromise
- Fake Cloudflare CAPTCHA verification pages
- Malicious clipboard-injected PowerShell/Terminal commands
- Reverse-tunnel backdoor network connections (specific C2 domains/IPs not disclosed in source reporting)
Remediation Steps
- 1
Restrict clipboard-to-terminal execution
Deploy endpoint controls or Group Policy to detect/block automatic paste-and-execute behavior in PowerShell and Windows Terminal, and enable PowerShell Constrained Language Mode / Script Block Logging.
- 2
User awareness training
Train users to recognize fake CAPTCHA/verification prompts that request running commands, emphasizing that legitimate CAPTCHAs never require terminal command execution.
- 3
Network egress monitoring
Monitor and restrict outbound connections for reverse-tunneling tools/protocols, and alert on unexpected long-lived outbound tunnels from workstations.
- 4
Credential and secret rotation
On any suspected compromise, rotate API keys, service account credentials, and tokens used by AI agents, RAG pipelines, or automation tools accessible from the affected host.
- 5
Application allow-listing
Implement application control (e.g., WDAC/AppLocker) to limit execution of unsigned or unusual scripts launched via terminal applications.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.