Microsoft Warns of Fake CAPTCHA Attack that Can Give Hackers Network Access

Hackers keep finding new tricks to fool computer users. Microsoft just found one of the sneakiest tricks yet. It is called TerminalFix, and it does not act like older scams.

This one can hand an attacker a secret path into an entire company network. Nobody needs to download a file for it to work. Instead, they just get tricked into copying and pasting one line of text.

How the Fake CAPTCHA Trick Works

TerminalFix starts on a website that hackers have already broken into. The site suddenly shows a fake box. It looks just like the Cloudflare “prove you are human” check that many real sites use. A person clicks the box, expecting normal access to the page. Instead, the site quietly copies a harmful command onto their clipboard.

The fake page then tells the victim to open Windows Terminal or PowerShell. It asks them to paste the command and press Enter. This step makes TerminalFix different from older scams like it, according to Microsoft.

Mac users face a similar threat. Security researchers have documented ClickFix campaigns that trick macOS users into pasting Terminal commands that download and run the Atomic macOS Stealer (AMOS), which targets browser credentials, Apple Keychain data, and cryptocurrency wallets from Exodus, Electrum, Atomic Wallet, Wasabi Wallet, and others.

Most older scams point victims to the simple Windows Run box. That box cannot handle long or complex commands well. Windows Terminal can. That gives hackers more room to run bigger, messier scripts that do more damage.

Once a victim pastes and runs the command, a hidden download begins. It grabs a ZIP file holding two things. One is a real, signed program that looks safe. The other is a harmful file hidden next to it. Together, they quietly unpack a hidden program straight into the computer’s memory.

Inside the Hidden Attack Chain

The attack does not stop there. In its next stage, the hackers hide more harmful code inside ordinary picture files. Three PNG images carry secret pieces of a program buried inside their pixels. The infected computer downloads these images from the attacker’s server. It then pulls the hidden code out and rebuilds it on the hard drive.

To stay on the computer long term, the attack sets up two backup plans. It adds itself to a scheduled task. It also adds itself to a Windows Registry key. Both are set to run again every single hour, even after a restart.

While it hides, the program quietly studies the network around it. It searches for domain controllers, databases, backup servers, and mail servers. It also gathers details about the computer itself and studies the wider company directory.

The most serious part comes next. The attack installs a custom tool built with Python. This tool creates a secret, encrypted tunnel that reaches out to an outside server. Once connected, the attacker can direct the infected computer to reach other devices sitting deep inside the same network.

This tunnel can even carry many connections at once. It also disguises its traffic to look like normal web browsing, and an attacker can shut it down remotely at any time.

Microsoft explained that this turns one infected computer into a bridge. Attackers do not stop at that first device. Instead, they use the tunnel to explore everything found earlier during their search of the network.

According to the Microsoft Security Blog, this bridge could later support things like credential theft, further access, or attempts to spread deeper into a network. As of this report, Microsoft has stated that it has not personally witnessed hands-on follow-up activity within the traced attack chain, though the tools involved could plainly support such moves.

How to Stay Safe From TerminalFix

There is no official patch for TerminalFix, since it does not rely on a software bug. It relies purely on tricking people. That means the strongest defense is awareness and good habits.

Never paste a command into Windows Terminal or PowerShell because a website told you to. Real verification checks never ask users to run commands. If a CAPTCHA behaves strangely, close the tab right away and avoid that site.

Companies should also limit who can run PowerShell commands freely. Turning on logging for PowerShell activity helps security teams catch strange behavior early. It also helps to watch for a program called LockScreenContentServer.exe showing up outside its normal folder. That file plays a key role in this attack chain, according to Bleeping Computer’s report on the campaign.

If someone thinks their device is already infected, they should act fast. It helps to check the network for signs of unusual movement between devices. Any shared passwords, especially high level administrator passwords, should be changed right away.

Scams like TerminalFix succeed only because people trust what a website tells them to do. Slowing down for a moment and refusing to blindly paste unknown commands, can stop this entire attack chain before it ever begins.