TerminalFix Hijacks Cloudflare CAPTCHAs to Slip Backdoor Past Windows Terminal

How TerminalFix Mimics Cloudflare to Earn Trust

Microsoft’s latest threat‑intel brief reveals a new ClickFix offshoot named TerminalFix. The campaign drops a phishing page that looks identical to Cloudflare’s familiar “I’m Under Attack” challenge. Instead of a simple JavaScript challenge, the spoofed page embeds a curl command that claims to verify the user’s browser. When a victim copies and runs the command in Windows Terminal or PowerShell, the payload silently establishes a reverse‑tunnel backdoor.

The Reverse‑Tunnel Architecture Explained

TerminalFix’s backdoor is not a traditional remote‑access trojan that opens a listening port on the victim. It initiates an outbound TLS‑wrapped tunnel to a command‑and‑control (C2) server, bypassing most inbound‑firewall rules. The tunnel is built on ssh -R over port 443, masquerading as legitimate HTTPS traffic. Once the tunnel is live, attackers can push additional modules, exfiltrate data, or pivot laterally within the compromised network.

Why PowerShell and Windows Terminal Are Ideal Execution Vectors

Earlier ClickFix variants relied on the Windows Run dialog (Win+R) to execute a single cmd line. That approach limited the payload to simple commands and made the attack more noticeable to security‑aware users. By shifting to Windows Terminal—a modern, multi‑tabbed console that defaults to PowerShell—the attackers gain two advantages:

• Rich scripting capability: PowerShell can download, decode, and execute binaries without invoking external tools, reducing the number of observable processes.
• Native admin escalation: Many enterprises have policies that automatically elevate PowerShell sessions for certain scripts, allowing TerminalFix to acquire higher privileges once the tunnel is live.

Detection and Mitigation Strategies

Because the malicious command is user‑initiated, classic endpoint‑detection‑and‑response (EDR) signatures that watch for suspicious child‑process trees often miss the initial payload. Defenders should instead focus on these indicators:

• Unusual outbound TLS connections to IPs not in the organization’s allow‑list, especially on port 443 from a Windows Terminal process.
• Execution of curl or Invoke-WebRequest with base64‑encoded payloads in PowerShell.
• Presence of fake Cloudflare verification pages in browser history or HTTP logs (look for URLs containing /cdn-cgi/challenge-platform/h/b that serve HTML instead of the real Cloudflare challenge).

Network‑level controls such as SSL/TLS inspection (where legally permissible) can surface the hidden SSH tunnel. Additionally, hardening Windows Terminal policies—disallowing arbitrary command execution from copied text—adds a friction layer that can stop the attack before it starts.

Impact on Enterprise Defenses

TerminalFix underscores a broader trend: attackers are weaponizing trusted UI patterns (CAPTCHAs, security banners) to gain execution footholds. The technique is especially potent in remote‑work environments where users frequently juggle multiple terminals and browsers. Organizations that have not yet applied strict application‑control policies to PowerShell may find themselves exposed to a low‑signal, high‑impact intrusion vector.

What Security Teams Can Do Right Now

1. Update detection rules: Add the specific curl command pattern observed in the Microsoft advisory to EDR signatures.
2. Enforce PowerShell Constrained Language Mode: Prevent execution of arbitrary .NET APIs used for base64 decoding.
3. Educate users: Highlight that legitimate Cloudflare challenges never ask users to run commands in a terminal.
4. Audit outbound TLS traffic: Flag any SSH‑style traffic that originates from a browser or terminal process.