The Attack That Hides Behind a Fake CAPTCHA

According to a report from The Hacker News, security researchers at Microsoft recently uncovered a new wave of attacks called TerminalFix. Hackers are using compromised websites to show visitors a fake Cloudflare CAPTCHA test. When someone clicks the "I am not a robot" button, the site tells them to copy and run a command in Windows Terminal or PowerShell.

This technique is especially dangerous because it tricks people into letting the attacker inside their own computer. Instead of just a pop-up that might be blocked, the user themselves pastes the malicious script. Once that script runs, it downloads hidden files and opens a secret tunnel from the victim's network back to the attacker. That tunnel lets the hacker move around inside the company's network as if they were sitting at a desk in the office.

Why the Reverse Tunnel Makes This a New Level of Threat

What makes TerminalFix stand out is the reverse-tunnel backdoor. Most malware sends a message out to the attacker, but this one actually creates a two-way pipe. The hacker can reach any device that the infected computer can see, like servers, printers, or other workstations. For Australian businesses, this means a single mistake by one employee could give an intruder a map of the entire internal network.

Attackers are also getting smarter about how they hide their steps. In this campaign, the malicious code was hidden inside ordinary-looking image files. The whole process is automated and hard to spot without proper monitoring. Traditional antivirus tools often miss these kinds of attacks because the bad code never touches the hard drive in a normal way.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia often have fewer layers of security than large corporations. Many rely on staff to make good decisions, but fake CAPTCHAs are designed to look completely legitimate. An employee who thinks they are just proving they are human will not hesitate to run a command—especially if the website looks real and the prompt appears professional.

Once the reverse tunnel is in place, an attacker can steal customer data, plant ransomware, or use the business's network to attack other companies. For an SMB, a breach like this can mean weeks of downtime, lost trust, and significant financial damage. The Australian Cyber Security Centre has warned that ransomware remains the top threat for local businesses, and this technique makes it easier for attackers to get inside.

What You Can Do Now

  • Restrict PowerShell and Terminal access. Use Group Policy or Microsoft Defender for Endpoint to block standard users from running PowerShell scripts unless they are signed and approved. Most employees never need to type commands into a terminal.
  • Train your team to spot fake verification prompts. Legitimate CAPTCHAs never ask you to copy and paste text into a Run dialog or a terminal window. Teach staff to stop and report any page that gives such an instruction.
  • Enable script block logging. Turn on PowerShell script block logging in your Windows security settings. This will record all commands run on your systems and help you detect suspicious activity early.
  • Use application whitelisting. Tools like Windows Defender Application Control or AppLocker can prevent unknown DLL files from loading. That stops the sideloading trick used in TerminalFix.
  • Monitor for unexpected outbound connections. Check your firewall logs for traffic to unusual domains on port 443. The reverse tunnel in this attack used an encrypted WebSocket channel that might look like normal HTTPS traffic.

If your business needs help tightening these controls or reviewing your current security posture, the team at MS&VG can guide you through practical steps that match the size and budget of your organisation. Staying safe from attacks like TerminalFix does not require a massive IT budget—just a plan and the right advice.