TerminalFix Alert: Phishing Campaign Uses Fake Cloudflare CAPTCHAs to Deploy Reverse Shells on macOS and Linux
Executive Summary
Cybersecurity researchers have uncovered an evasion-focused evolution of the "ClickFix" social engineering tactic, dubbed "TerminalFix", designed specifically to compromise macOS and Linux systems (The Hacker News). The campaign displays deceptive Cloudflare Turnstile "Verify you are human" verification prompts on compromised web pages, tricking developers, system administrators, and technical users into copying and executing malicious shell commands inside their local Terminal. Once pasted, the payload establishes persistent reverse shells, dumps local SSH keys, and exfiltrates cloud credentials.
Deep-Dive Technical Analysis
Social Engineering Workflow & Clipboard Hijacking
While traditional ClickFix campaigns targeted Windows users by instructing them to press Windows + R and paste PowerShell snippets into the Run dialog, TerminalFix specifically targets Unix-based operating systems widely used across software engineering and cloud administration teams:
1. Deceptive Cloudflare Overlay: Victims visiting compromised or attacker-controlled websites are presented with an authentic-looking modal mimicking a Cloudflare Turnstile verification challenge stating: "Verification failed. Please complete manual browser check."
2. Multi-Step Terminal Lure: The interface provides instructions instructing the user to press Cmd + Space (to launch macOS Spotlight) or open their Linux Terminal, followed by pressing Ctrl + V / Cmd + V and Enter to execute an alleged "verification key."
3. Invisible Clipboard Payload: When the user clicks the "Copy Verification Code" button, client-side JavaScript populates the system clipboard with an obfuscated, base64-encoded one-line shell command (e.g., curl -sSL https://... | bash or Python reverse shell scripts).
4. Post-Exploitation Execution: Upon execution, the script initiates a background daemon that connects back to an attacker-controlled Command-and-Control (C2) server, granting the adversary interactive root or user-level shell access.
5. Automated Credential Harvesting: The script immediately searches the filesystem to exfiltrate SSH private keys (~/.ssh/id_rsa, id_ed25519), cloud environment credentials (~/.aws/credentials, ~/.azure, ~/.config/gcloud), environment files (.env), and browser SQLite session databases.
Threat Modeling for Developers & DevOps Engineers
TerminalFix exploits a critical security gap in corporate environments where developer workstations hold master keys to production cloud infrastructure:
* Bypassing Traditional Email & Web Filters: Because the malicious payload is copied via clipboard API interactions rather than downloaded as an executable file, traditional Web Gateways, Secure Email Gateways (SEGs), and static network file scanners fail to inspect or block the attack.
* Lateral Traversal into Cloud Environments: Compromising a single developer's terminal provides attackers with active AWS, GCP, and Kubernetes access tokens, allowing adversaries to bypass external firewalls and compromise central production clusters.
Actionable Recommendations & Mitigations
1. Enable Terminal Execution Warnings: Configure modern terminal emulators (such as iTerm2, macOS Terminal, and Linux terminal shells) to display confirmation dialogs before executing multi-line or pasted commands containing newlines.
2. Enforce EDR Script-Block Auditing: Deploy Endpoint Detection and Response (EDR) agents configured to detect and alert on anomalous child process spawning (such as bash, sh, zsh, or python3 initiating external outbound network connections directly from user shells).
3. Mandate Hardware-Bound FIDO2 Keys: Enforce phishing-resistant hardware security keys (FIDO2/WebAuthn) for all cloud provider and version control access, preventing adversaries from replaying stolen static session tokens or passwords.
4. Adopt Ephemeral Cloud Credentials: Eliminate static access keys stored in ~/.aws/credentials by mandating short-lived IAM roles with AWS IAM Identity Center or single sign-on (SSO) session tokens with tight time-to-live (TTL) limits.
________________
Sources & References: The Hacker News.