The attack chain relies on fake Cloudflare CAPTCHA pages that prompt users to verify they are human. Instead of a simple checkbox, the page instructs the user to copy a command and paste it into a terminal. Once pasted, the command establishes a reverse-tunnel backdoor on the system, giving the attacker remote access without requiring traditional malware files to be dropped on disk.

• The fake CAPTCHA page mimics Cloudflare branding to appear legitimate.
• The malicious command is obfuscated and designed to run in Windows Terminal or PowerShell.
• The backdoor uses a reverse tunnel to connect outbound, bypassing many firewall restrictions.

Microsoft notes that this shift from the Run dialog to full-featured terminals increases the success rate of the attack, as users are more accustomed to pasting commands in these environments. The payload itself is delivered entirely in memory, leaving fewer forensic traces on the host.

To mitigate this threat, users should avoid pasting commands from web pages into terminals unless they fully understand the command's purpose. Organizations should also monitor for unusual outbound connections and restrict PowerShell execution policies where possible.

Source: The Hacker News

Has your team tested user awareness against fake CAPTCHA prompts that instruct pasting into a terminal, and what was the click-through rate?