This article addresses the secure finite-time tracking problem via event-triggered command-filtered control for nonlinear time-delay cyber physical systems (CPSs) subject to cyber attacks. Under the attack circumstance, the output and state information of CPSs is unavailable for the feedback design, and the classical coordinate conversion of the iterative process is incompetent in relation to the tracking task. To solve this, a new coordinate conversion is proposed by considering the attack gains and the reference signal simultaneously. By employing the transformed variables, a modified fractional-order command-filtered signal is incorporated to overcome the complexity explosion issue, and the Nussbaum function is used to tackle the varying attack gains. By systematically constructing the Lyapunov–Krasovskii functional, an adaptive event-triggered mechanism is presented in detail, with which the communication resources are greatly saved, and the finite-time tracking of CPSs under cyber attacks is guaranteed. Finally, an example demonstrates the effectiveness.