“While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully,” the company said in a blog post.
The company has provided detection coverage, IOCs, hunting queries, and mitigation and response guidance for the observed activities.
‘Prove you’re human’ gets decidedly inhuman
The initial lure is a fake Cloudflare CAPTCHA verification overlay displayed on compromised websites. But instead of simply asking a visitor to click a checkbox, the prompt instructs to copy and execute a PowerShell command.
Click Here For The Original Source.
