On the basis of fully actuated system (FAS) method, this research focuses on the solution to a secure tracking control problem of cyber-physical systems (CPSs) under a type of hybrid attacks, where a unified framework of hybrid attacks is given to indicate the impacts of random denial-of-service attacks and random false data injection attacks in the forward and backward channels. A FAS terminal sliding-mode predictive control scheme is proposed to achieve the desired secure tracking control performance. First of all, a FAS model of CPSs is constructed to describe the actual dynamics, which is named the fully actuated cyber-physical system (FACPS). Then, a terminal sliding-mode is introduced to defend the hybrid attacks by enhancing the system robustness, and an incremental FAS prediction model of terminal sliding-mode is established via a Diophantine Equation. Through this incremental FAS prediction model, the multistep predictions of terminal sliding-mode are constructed to minimize an objective function for obtaining an optimal secure tracking controller. A sufficient condition of the closed-loop FACPS is derived to discuss the bounded stability and tracking performance with the help of the linear matrix inequality approach. Finally, the proposed FAS terminal sliding-mode predictive control scheme offers a solution to the tracking control of air-bearing spacecraft simulator for verifying the feasibility and practicality.