The fake CAPTCHA trick has moved house: it now asks for Windows Terminal

For two years the advice about fake CAPTCHA pages has ended the same way: nothing legitimate ever asks you to press Win+R and paste something. Microsoft Threat Intelligence published research on 28 August on a variant it calls TerminalFix, and it has quietly moved the goalposts. The page still shows a counterfeit Cloudflare "verify you are human" box. It still copies a command onto your clipboard behind your back. But now it tells you to open Windows Terminal or PowerShell instead, because, as Microsoft puts it, that makes it "more likely that complex, multi-line scripts execute successfully."

What happens next is worth knowing, if only to appreciate the effort. The pasted command prints reassuring "Starting Cloudflare verification" lines in cheerful colours while it fetches a ZIP holding one genuine signed Windows file and one malicious DLL sitting next to it. Later stages arrive hidden in the pixels of PNG images pulled from a couple of throwaway domains. It schedules itself to run every hour, has a look around the network, then opens an encrypted tunnel back out to whoever sent it. Microsoft saw no hands-on activity yet, which mainly means the door was propped open and nobody had walked through it.

So widen the rule rather than swapping it. No verification step, error message, video player or download page needs you to open a terminal of any kind and paste something into it. Not the Run box, not PowerShell, not Windows Terminal. If a web page is giving you keyboard instructions, it isn't checking whether you're human - it's asking you to do the one part it can't do itself. We covered the original version of this trick in June, and the tell hasn't changed a bit.

If you already pasted something and you're uneasy about it, Tendvane can't tell you what ran - it's not an antivirus and it doesn't remove malware. What its Safety check does show is anything new that installed itself along the way, and the Privacy and accounts check lists which accounts are signed in on that PC, which is the order you want to change passwords in.