What changed

Microsoft describes an intrusion that begins on a compromised website displaying a fake Cloudflare Turnstile verification overlay, complete with the Cloudflare logo and a Verify you are human checkbox. The overlay silently copies a malicious PowerShell command to the user’s clipboard, and the on-screen instructions tell the user to open Windows Terminal or PowerShell and paste the command. Microsoft states the distinction from earlier campaigns directly: traditional ClickFix campaigns direct victims to the Windows Run dialog, while TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully. The chain retrieves an archive pairing a legitimate signed binary with a malicious library, and the implant that lands is described as a Python-based reverse tunnel providing SOCKS-style TCP proxy access which turns the victim into a full network pivot point, enabling attackers to reach any host visible from the victim’s network. Persistence is a scheduled task that re-executes every 60 minutes. On targeting, Microsoft says only that the campaign targets organisations across multiple industries, and names no country and no sector.

The risk is that this attack does not need a vulnerability, an attachment or an administrator. It needs one person following instructions that look like a routine website check, on a machine that is otherwise fully patched. Every control that inspects a file or a link is standing in the wrong place, because the user is the delivery mechanism and the command arrives on the clipboard rather than over the wire. What makes it worth a board-level sentence rather than a security-team footnote is what the payload does next: it makes one ordinary laptop into a route to everything that laptop can reach.

What the term means in plain language

ClickFix is the established name for a class of attack in which the victim is persuaded to run the attacker’s command themselves. The page presents a plausible obstacle, most often a verification check or an error that needs fixing, and supplies the remedy as a command the user is told to paste and run. Nothing is downloaded by the browser and nothing is opened from an email, so the delivery step leaves very little for a mail gateway or a web filter to inspect. TerminalFix is Microsoft’s name for a variant of that pattern which changes where the victim is sent to do the pasting.

This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.

Why this matters to a South African organisation

South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.

The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.

The hidden exposure

Microsoft Threat Intelligence published research on 28 August 2026 into a campaign it calls TerminalFix. A compromised website shows a fake Cloudflare verification overlay which silently copies a PowerShell command to the clipboard, and instructs the visitor to paste it into Windows Terminal or PowerShell. Microsoft’s stated reason for the change from the older pattern is that it increases the likelihood that complex, multi-line scripts execute successfully.

Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.

Decision path

The decision this forces is where to spend effort, and the honest answer is that the most valuable control here is nearly free. Microsoft’s own mitigation list includes configuring Windows Terminal to warn users when the text they are pasting contains multiple lines. It blocks nothing and it defeats no determined attacker, but it interrupts the exact moment the attack depends on, which is a person pasting something they did not write into a window they rarely use. Set against an application control programme, it costs an afternoon. The second decision is about the instruction you give people, and it is worth being precise rather than general. Security awareness training that says be careful online does not help here, because the victim believes they are completing a routine check rather than taking a risk. A single specific sentence does help, and it is Braintree’s phrasing rather than Microsoft’s: no genuine verification check ever asks you to paste something into a terminal. That is a rule a person can apply without judgement, in the moment, and it is narrow enough to be remembered. The third decision belongs to whoever is comfortable with how much one laptop can reach. Microsoft’s description of the payload is not that it steals a password but that it turns the machine into a full network pivot point reaching any host visible from the victim’s network. In a flat network that is the whole estate, so the question this research puts to a South African business is less about the campaign and more about what a single compromised machine on the office network can currently see.

Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.

Technical test plan

Take the mitigations in the order of what they cost. The Windows Terminal paste warning is a setting, and it addresses the delivery step rather than the payload; Microsoft lists it explicitly. Enable network protection and web protection in Microsoft Defender for Endpoint and cloud-delivered protection in Microsoft Defender Antivirus, which is where the compromised site and the retrieval step are most likely to be caught. Enable PowerShell script block logging, which matters twice over: it gives detection something to alert on, and it gives an investigation the actual text of what was pasted, which is otherwise the piece of evidence hardest to recover after the fact. Beyond that, Microsoft recommends restricting PowerShell and Run dialog execution using AppLocker, Application Control for Windows or Group Policy, an App Control policy that prohibits the launch of native Windows binaries from Run, enforcing PowerShell Constrained Language Mode, and enabling attack surface reduction rules. Those are real projects with real user impact and they are worth planning rather than rushing. On detection, Microsoft also recommends alerting on the legitimate binary named in the write-up executing from a non-standard path, which is the generic shape of every DLL sideloading case: a signed executable is not suspicious, and a signed executable running from the wrong directory is. Two things this article deliberately does not carry, and the omission is a choice rather than an oversight. It does not repeat the specific file names, the forged timestamp or the Defender detection names, all of which are in Microsoft’s post and none of which changes what a business decides; a detection engineer should read the source rather than a summary. And it does not name a threat actor, because Microsoft does not.

Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.

Primary owner

Primary owner: Whoever owns endpoint security, normally the IT or security lead who controls Microsoft Defender policy and Windows configuration, with whoever runs internal staff communications.

The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.

Action within seven days

Action within seven days: Configure Windows Terminal to warn when pasted text contains multiple lines, which is Microsoft’s own recommendation in this write-up and is a setting rather than a project. Confirm that network protection and web protection are enabled in Microsoft Defender for Endpoint, that cloud-delivered protection is on in Microsoft Defender Antivirus, and that PowerShell script block logging is enabled. Then send one short internal message this week: no genuine verification check ever asks you to paste something into a terminal.

Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.

Evidence to retain

Evidence to retain: A dated record of the Windows Terminal paste-warning setting as deployed, the Defender for Endpoint policy showing network protection and web protection enabled, the attack surface reduction rule state, confirmation that script block logging is on, and the internal communication as sent with its distribution date.

Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.

Frequently asked questions

Is this a new vulnerability we need to patch?

No. The initial access step relies on the user running the command themselves, so there is no patch for the entry point. The controls that help are the ones that interrupt or restrict what a pasted command can do.

How is this different from the ClickFix attacks we have already been warned about?

Microsoft states the difference plainly: traditional ClickFix campaigns direct victims to the Windows Run dialog, while TerminalFix directs them to Windows Terminal or PowerShell instead, which increases the likelihood that complex, multi-line scripts execute successfully.

What does the payload actually do?

Microsoft describes a Python-based reverse-tunnel implant providing SOCKS-style TCP proxy access, which turns the victim into a full network pivot point and enables attackers to reach any host visible from the victim’s network. A scheduled task re-executes it every 60 minutes.

Are South African organisations being targeted specifically?

Microsoft says only that the campaign targets organisations across multiple industries. It names no geography and no sector, and neither does this article.

Is Defender already blocking it?

Microsoft lists detections in Microsoft Defender Antivirus and behavioural detections in Microsoft Defender for Endpoint, described as coverage available to customers. Microsoft does not state that these block by default, so treat the recommended settings as things to confirm rather than assume.

What is the single most useful thing to do this week?

Configure Windows Terminal to warn on multi-line paste, and send one short internal message saying that no genuine verification check ever asks you to paste something into a terminal. The setting is Microsoft’s recommendation; the sentence is ours.

Should we block PowerShell outright?

Microsoft lists restricting PowerShell and Run dialog execution through AppLocker, Application Control for Windows or Group Policy, and enforcing Constrained Language Mode. These are effective and they are also disruptive, so they belong in a planned piece of work rather than in a same-week response.

The Braintree view

Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.

Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.