A new attack family targets developers with a fake Cloudflare verification page that copies a backdoor into the clipboard—and asks you to paste it yourself into your terminal.

TerminalFix: Fake Cloudflare CAPTCHA, Real Backdoor in Your Terminal

What's Happening

TerminalFix is a new type of social engineering campaign that directly targets the reflexes of technical profiles. No browser exploit, no compromised npm package: in this case, you install the backdoor, convinced you're performing a legitimate verification.

The scenario: a compromised site displays a fake Cloudflare verification page, pixel-perfect—button, spinner, logo, colors identical to the original. In the background, the "verification" silently copies a malicious command to your clipboard. A message appears: "To finalize, open your terminal and paste this command." You execute it. It's done.

The command deploys a reverse tunnel to a C2 server: an outgoing connection from your machine, which the firewall allows. The attacker gains persistent and interactive access—even behind NAT or corporate firewall—using legitimate tools like ngrok, frp, or chisel.

Why Developers Are the Perfect Target

The attack is calibrated for technical profiles. A developer always has a terminal open, finds it normal for a "security verification" to ask for terminal intervention, and executes it automatically. The antivirus detects nothing—it's a legitimate user typing a command. No traces in authentication logs.

This is the direct evolution of ClickFix attacks documented since 2024, applied to the terminal rather than the browser. The vector is distinct from supply chain compromises (npm, PyPI packages): it requires no compromised infrastructure on the developer's side.

What to Do Now

To Do Now

1. Absolute rule: no legitimate website will ever ask you to open a terminal and paste a command. Close the tab immediately.
2. Read the clipboard before pasting: pbpaste (macOS), xclip -o or wl-paste (Linux) to view the content without executing it.
3. Look for active tunnels: ss -tp (Linux) or lsof -i (macOS) for persistent outgoing connections to unknown hosts.
4. Check for unintended ngrok/frp/chisel: which ngrok frp chisel.
5. Raise awareness in your team: junior devs are the most exposed—share this article.