The instinct, once Microsoft published TerminalFix, is to blame the paste. Draft the same ClickFix reminder you sent last quarter. Tell people never to run commands from a webpage. Fine. Then look at what actually changed.

Attackers moved ClickFix out of the Windows Run dialog and into Windows Terminal and PowerShell because they needed a real interpreter. They wrapped the ask in a fake Cloudflare CAPTCHA because that prompt is the one your users complete without reading. If your cybersecurity program still files this under awareness, you’re measuring the wrong control. You’ll get another campaign next month with a different skin. The interpreter and the fake verification page will still be the mechanism.

You Already Trained Them to Obey the Box

You’ve spent years teaching people to complete human checks. Bot walls, “verify you are human,” the little Cloudflare widget that appears in front of half the internet. Users don’t inspect those pages. They click. They wait. They copy the next instruction the page gives them, because that’s how the ritual works.

TerminalFix uses that ritual as the loader. Microsoft’s disclosure describes a ClickFix variant that sends victims to Windows Terminal or PowerShell instead of the Run dialog, behind a fake Cloudflare CAPTCHA. Traditional ClickFix already got people to execute attacker text. This version raises the ceiling on how much attacker text you can run in one sitting. A reverse-tunnel backdoor fits in a shell one-liner. It does not fit comfortably in Win+R.

Your firewall never sees a CVE. Your threat-protection stack, if it’s waiting for a dropped executable or a brute-force spray against SSH, is watching the wrong door. The browser rendered a page that looked like infrastructure. The user opened a privileged interpreter and pasted. That’s instructed execution, and most cyber security programs still treat it as a lapse in judgment rather than a path you can instrument.

Cloudflare’s real widget is boring on purpose. That’s why the clone works. Users have muscle memory for the checkbox, the turnstile, the “review the security of your connection” copy. A sloppy clone still converts because the alternative, for the user, is sitting on a frozen page. You’ve designed patience out of the verification step. TerminalFix is collecting that design.

The Run Dialog Was a Shackled Interpreter

Win+R is a launcher. You can do damage with it. You can also run out of room. PowerShell and Windows Terminal are different animals. Encoded commands, download cradles, multi-stage logic, environment probes, persistence that doesn’t look like a .exe in Downloads. Once the user is in a real shell, the social-engineering payload can look like the same kind of “fix” your own help desk pastes into tickets.

That’s the part worth sitting with. Attackers didn’t pick Terminal because it looks scarier. They picked it because your environment already treats those binaries as normal user tools. Developers have them. Help desk has them. The person who got the fake captcha might have used PowerShell last week to reset a store app, because a support article told them to.

A Start Menu Icon Does Not Make a Shell Safe

Open the Start menu on a standard workstation. PowerShell is there. Windows Terminal is there. No extra prompt that says this runtime can rewrite scheduled tasks, pull a remote payload, and hold an outbound tunnel. Your defense in depth diagram probably puts “endpoint” as a box and “user” as a stick figure. TerminalFix lives in the gap between those two drawings. The user is the process parent. The shell is the exploit.

If your threat detection doesn’t alert on powershell.exe or wt.exe spawning from a browser-driven workflow, or on a first-time Terminal launch followed by outbound traffic to an unknown host, you’re going to learn about this from the tunnel, not from the paste. Clipboard and DLP tools that only watch Outlook attachments miss the same path. The interesting event is a console that should not have opened, followed by a network call that console should not have made.

Instructed Execution Is a Cybersecurity Blind Spot

Here’s what to change in a real environment. Vendor-neutral. No new logo required. Security hardening for this path is about who may launch a shell, what that shell may do, and whether incident response treats a pasted command as a full compromise.

1. Immediate: Turn on PowerShell script block logging, module logging, and transcription everywhere you still allow the engine. If you can’t read the command that ran, you can’t do threat detection on this family at all.
2. Immediate: Restrict who can launch powershell.exe, pwsh.exe, and Windows Terminal. Standard users who never administer anything don’t need a console on the Start menu. Application control such as WDAC or AppLocker is the control. A GPO that hides the icon is theater.
3. Immediate: Turn on constrained language mode for non-admin users where you can live with it. You will break some internal scripts. Those scripts should run signed, from a repo you own, under an account that is supposed to be privileged.
4. Immediate: Alert on process ancestry. Browser or Explorer launching Terminal or PowerShell, especially with EncodedCommand, IEX, DownloadString, or a hidden window, is an incident, not a curiosity. Wire that into the same queue you use for malware detonations.
5. Ongoing: Treat help-desk paste-this-into-PowerShell culture as attacker documentation. Rewrite those runbooks to use signed installers, MDM, or a privileged jump box. Every ritual you teach is a ritual they can clone, including the fake captcha that pretends to be a vendor check.
6. Ongoing: Assume the first paste worked. Incident response for instructed execution means isolating the host, rotating credentials that touched it, and hunting for tunnels and new services. Skip the wait for a named malware family in the threat-protection console.

You already have logs that would have shown this. Script block logging is old. Process creation events are old. The gap is the playbook that files “user ran PowerShell” under noise, next to the same event your admins generate all day. Split the stream. Privileged, expected, signed. Everything else is hostile until proven otherwise.

Keep dropping brute-force noise at the firewall. That work is real. It doesn’t observe a user who already passed every identity check and then opened a shell because a page said Verify. Defense in depth for TerminalFix is identity plus execution control plus egress. A louder awareness banner will not close this.

Frequently Asked Questions

Is TerminalFix just ClickFix in a different window?

The window change is the story. PowerShell and Windows Terminal accept staged, encoded, networked payloads that the Run dialog made clumsy. If you recycle last year’s ClickFix poster, you miss the control that actually moved: who can open a full interpreter.

Should we ban PowerShell on every workstation?

Ban it for people who have no job reason to use it. Keep it for admins, on a jump host, with logging you actually read. A blanket ban you immediately punch holes through for IT will recreate the same Start-menu problem with extra steps.

Will better captcha training stop this?

Training that says “don’t complete fake captchas” fails the moment the page looks like Cloudflare. Train a concrete refusal: no website, including one that claims to be a security check, gets to tell you to open Terminal or PowerShell. Pair that with the technical constraints above or the next clone ships on Monday.

Sources

• TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor