Microsoft Warns Of New TerminalFix Attack Using Fake CAPTCHAs To Hack Windows Systems
Microsoft has uncovered a new cyberattack called TerminalFix, which uses fake CAPTCHA pages to trick users into installing dangerous backdoor malware.
Published : September 1, 2026 at 7:21 PM IST
Hyderabad: Microsoft Threat Intelligence, the tech giant's cybersecurity wing, has revealed details of a new cyberattack technique called TerminalFix, which tricks users into running harmful commands on their computers through Windows Terminal or PowerShell.
According to Microsoft's cybersecurity researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan, TerminalFix is a variant of an older attack method known as ClickFix. While older ClickFix attacks targeted the Windows Run dialogue box, this new version pushes victims towards Windows Terminal or PowerShell instead, allowing attackers to run more complex, multi-step commands.
Microsoft Security Research is investigating a TerminalFix campaign, a variant of the ClickFix technique, that leads to a reverse-tunnel implant capable of providing network-level proxy access through a compromised host.
— Microsoft Threat Intelligence (@MsftSecIntel) August 28, 2026
This TerminalFix campaign uses fake CAPTCHA verification… pic.twitter.com/dnY2VEYElJ
How does the attack happen?
The attack begins on websites that have already been compromised by hackers. These sites display fake Cloudflare CAPTCHA verification pages, encouraging visitors to copy and run a malicious command without realising the danger.
Microsoft warned that this type of access is especially dangerous because it gives attackers a foothold inside an organisation's private network. From there, they could potentially raise their access levels, turn off security tools, steal sensitive data, or install ransomware.
The malware also includes a monitoring system that constantly checks for new instructions from the attacker and carries them out automatically, making the infection more persistent and harder to remove.
How can organisations protect themselves from this cyberattack?
To protect against TerminalFix, Microsoft has issued several recommendations for organisations. These include limiting who can use PowerShell and the Run dialogue box, using tools such as AppLocker or Group Policy to control access, and considering whether to block the Run dialogue entirely if it is not needed.
Businesses are also advised to monitor for signs of DLL sideloading, train staff to recognise fake CAPTCHA and ClickFix-style scams, and turn on PowerShell script block logging. This logging feature helps security teams detect and investigate suspicious or hidden commands before they cause serious harm.
Microsoft's warning highlights the growing sophistication of cyberattacks that rely on tricking users rather than exploiting software flaws, making employee awareness a key line of defence.
