TerminalFix ClickFix Campaign: Microsoft’s Response (Aug 29)
Quick Answer
Microsoft reveals the TerminalFix ClickFix campaign, Edge 152 ships with new protections, and Copilot adds tab summarization and interactive slides.
- • TerminalFix reverse tunnel: A ClickFix variant uses fake Cloudflare Turnstile overlays to get users to paste PowerShell into Windows Terminal, then chains DLL sideloading, PNG steganography, AD reconnaissance, and a Python reverse tunnel (Microsoft Security Blog, Aug 28, 2026).
- • Edge 152 stable: Microsoft Edge 152.0.4191.53 shipped to Stable on August 27 as the first release on the two-week cadence, auto-unsubscribing from scam notifications and adding Apple account sign-in (learn.microsoft.com, Aug 27, 2026).
- • Edge Copilot grounding: Copilot summarization for multiple tabs and YouTube videos is generally available now; Word, Excel, and PowerPoint support moves to mid-September. The feature is off by default and needs M365 Copilot (Message Center MC1187682, updated Aug 28, 2026).
- • PowerPoint interactive slides: Copilot in PowerPoint can build interactive full-page visuals on Windows now, with Mac completing rollout by early September under the Frontier preview (Message Center MC1461152, updated Aug 28, 2026).
01TerminalFix Campaign Deploys a Reverse Tunnel
Microsoft Threat Intelligence has observed a TerminalFix campaign, a ClickFix variant, that tricks users into pasting a malicious PowerShell command behind a fake Cloudflare Turnstile overlay and eventually installs a reverse-tunnel backdoor with network-level access to the organization. The research, published August 28 on the Microsoft Security Blog, describes an attack chain that goes well beyond a typical credential stealer.
The intrusion starts on a compromised website that displays a fake Cloudflare CAPTCHA verification overlay. Users are told to copy and paste a verification command, and that command runs a disguised PowerShell script that downloads a ZIP archive, extracts it to ProgramData, and silently launches a batch file. The twist is delivery: while classic ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix directs them to Windows Terminal or PowerShell instead, which Microsoft says increases the likelihood that complex, multi-line scripts execute successfully.
“
While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully.
Microsoft Security Blog, TerminalFix campaign deploys a reverse tunnel (Aug 28, 2026)
The payload is signed and multi-stage. The ZIP contains a legitimate binary, LockScreenContentServer.exe, and a malicious DLL named dui70.dll that side-loads and drives the next stage: payloads hidden inside PNG images are extracted with steganography, and persistence is established twice through Registry Run keys and scheduled tasks. The implant then performs thorough Active Directory reconnaissance – domain trust enumeration, domain admin discovery, user description harvesting, and targeted server ping sweeps – before deploying a Python reverse-tunnel implant that carries arbitrary TCP traffic through an encrypted WebSocket channel back to attacker infrastructure.
For defenders, the most important takeaway is that the reverse tunnel turns any infected device into a network jump host: attackers can reach internal systems that never touched the original lure. Microsoft recommends treating affected machines as compromised, investigating lateral movement and credential exposure, and hardening the human layer with guidance against pasting commands from web pages into elevated shells. Keeping devices on a current, genuinely licensed Windows build reduces both exposure and activation churn; our Windows license buying guide covers legitimate sourcing and upgrade paths.
02Edge 152 Stable Ships With New Protections
Microsoft Edge 152 (152.0.4191.53) reached the Stable channel on August 27 as the first major release on the browser’s new two-week cadence, adding automatic unsubscribing from scam notifications, Apple account sign-in, richer password controls, and new Copilot policies. Microsoft published the release notes on learn.microsoft.com, alongside the completion of the accelerated update schedule announced in June.
The headline protection is notification hygiene. When a web notification leads users to a site that Microsoft Defender SmartScreen blocks as a scam, phishing, or malware page, Edge now automatically stops that source from sending further notifications and tells users what happened. Any site can be reviewed and restored under edge://settings/privacy/sitePermissions/allPermissions/notifications. The feature is rolling out progressively, so not every profile sees it immediately.
Sign-in flexibility also improves: users can now sign in to Edge with an Apple account on Windows and macOS, alongside the Microsoft account option, with admins able to control it through the NonMicrosoftAccountSignInEnabled policy. The key icon in the address bar gains a detailed credential panel where users can copy a username, reveal and copy a password, and attach personal notes to each login. Edge also retires real-time video translation and the Drop feature in version 152, and web developers should note the unload event deprecation rolling out across versions 152-155. For admins, new and updated policies include CopilotCoworkToolActionsEnabled for Cowork browser actions and EdgeEntraCopilotPageContext for video transcription control.
The two-week cadence matters for enterprise planning because fixes and features now arrive roughly twice as often as before. The same week, Microsoft also moved WebView2 to a matching two-week runtime cycle, so IT teams managing browser and embedded-webview estates should treat August 27 as the start of a faster, smaller update rhythm rather than a one-off release.
03Edge Copilot Adds Tab and YouTube Summarization
Edge Copilot summarization with contextual grounding is now generally available for multiple tabs and YouTube videos, with Microsoft 365 document support in Word, Excel, and PowerPoint postponed to mid-September. Microsoft updated Message Center notice MC1187682 on August 28, revising the earlier end-of-August timeline for M365 document grounding.
The feature lets licensed users ask Copilot to summarize content across several open tabs or a YouTube video, with answers grounded in the actual page content. Three details matter for rollouts: the feature is off by default rather than auto-enabled; it requires Entra ID plus a Microsoft 365 Copilot license; and when DLP policies or the EdgeEntraCopilotPageContext policy restrict access, Edge suppresses page content access accordingly. Microsoft’s roadmap entries for the capability are IDs 496364, 499423, and 499424.
For administrators, the delay of Word, Excel, and PowerPoint grounding to mid-September is the planning signal: communications training and pilot cohorts should target that window rather than this week. The default-off posture also means users will not suddenly see summarization prompts everywhere, which gives governance teams time to review data-boundary and DLP settings before enabling the experience broadly.
04PowerPoint Copilot Creates Interactive Slides
Copilot in PowerPoint can now build interactive, full-page visuals for explaining complex concepts, timelines, comparisons, system relationships, and data, in a new skill tracked as MC1461152 and updated August 28. The capability is part of the Frontier plan preview, rolling out now on Windows desktop with Mac completion expected by early September.
Interactive slides are a different output from a normal generated deck: instead of static bullet points, Copilot produces full-page visual experiences users can navigate and click through, which suits onboarding, product explainers, and dense technical topics. Microsoft says no admin action is required for the rollout, and availability follows the standard progressive release pattern.
This is the second Copilot surface to change this week, alongside Edge Copilot summarization, and it continues the pattern of Microsoft pushing Copilot deeper into specific work surfaces rather than only the chat sidebar. Presenters on Windows can try it today; Mac users should see it complete by early September, and teams running Frontier should include the interactive-slides capability in their enablement plans.
05What This Means for Windows Users and IT Teams
The August 29 news cycle pairs a serious, actively observed intrusion campaign with two Copilot expansions and a faster-moving Edge browser – a mix that rewards quick training updates more than emergency patching. None of these require an immediate action today, but each has a rollout window or a security implication already in motion.
For Windows users: Edge 152 updates itself automatically, so the scam-notification unsubscribe becomes passive protection once the progressive rollout reaches you. The bigger behavioral ask is the TerminalFix lesson: never paste a command from a web page into Windows Terminal, PowerShell, or the Run dialog, even when a CAPTCHA-style page insists it is verification. If you use Copilot in Edge or PowerPoint, expect summarization prompts and interactive slide options to appear gradually; both features require a Microsoft 365 Copilot license and are either off by default or in preview. For upgrade and edition questions around Copilot-ready hardware, the Windows 11 Pro vs Home guide covers what changes at each tier, and our Windows 10 vs Windows 11 comparison helps with migration timing.
For IT and security teams: TerminalFix should trigger a review of ClickFix mitigations – restrict or monitor clipboard-to-shell behavior, enforce application control, and verify endpoint detection coverage – and any confirmed infection should be treated as a network breach candidate, not a single-machine cleanup. On the Edge side, plan for the new policies (NonMicrosoftAccountSignInEnabled, CopilotCoworkToolActionsEnabled, EdgeEntraCopilotPageContext) and document the faster two-week cadence for change windows. On the Copilot side, Edge document grounding arrives mid-September and PowerPoint interactive slides complete on Mac by early September; both are good candidates for controlled pilots under the Frontier program.
The through-line is that security and AI are converging on the same surface: the browser and the shell. Microsoft is shipping faster browser updates and stronger notification defenses while expanding Copilot across tabs, videos, and slides – and attackers are now weaponizing the exact copy-paste trust those experiences depend on. Teams that update training, policy, and pilot plans this week will be ready before the September wave.
FAQ
What is the TerminalFix campaign?
TerminalFix is a ClickFix-style campaign observed by Microsoft Threat Intelligence and detailed on August 28. It uses fake Cloudflare Turnstile overlays on compromised websites to get users to paste a malicious PowerShell command into Windows Terminal or PowerShell, then chains DLL sideloading, PNG steganography, dual persistence, AD reconnaissance, and a Python reverse tunnel that can proxy traffic into the internal network (Microsoft Security Blog, Aug 28, 2026).
How do I get Microsoft Edge 152 and its new protections?
Edge Stable updates automatically; version 152.0.4191.53 began rolling out August 27, with progressive delivery over several days. The scam-notification unsubscribe is a controlled rollout, so check back if it is not visible yet, and restart the browser after the update applies (learn.microsoft.com Edge Stable release notes, Aug 27, 2026).
When will Edge Copilot summarize Word, Excel, and PowerPoint documents?
Per Message Center MC1187682, updated August 28, multi-tab and YouTube summarization is generally available now, while Microsoft 365 document grounding is postponed to mid-September. The feature is off by default and requires Entra ID plus a Microsoft 365 Copilot license (Message Center MC1187682, Aug 28, 2026).
Who can use PowerPoint Copilot interactive slides?
The interactive full-page visuals skill is available now on Windows desktop and rolling out to Mac, with completion expected by early September, as a preview under the Frontier plan. Microsoft says no admin action is required (Message Center MC1461152, updated Aug 28, 2026).
Is the new Edge two-week cadence the same as the WebView2 change?
They are related but separate. Edge 152 is the first Stable browser release on the new two-week cadence, and Microsoft also moved the WebView2 runtime to a two-week cycle the same week. IT teams managing both browser and embedded-webview estates should plan for smaller, more frequent updates (learn.microsoft.com and Microsoft Edge Blog, Aug 2026).
External References
- • Microsoft Security Blog: TerminalFix campaign deploys a reverse tunnel through multistage intrusion (Aug 28, 2026)
- • Microsoft Learn: Edge Stable Channel release notes – Version 152.0.4191.53 (Aug 27, 2026)
- • Microsoft Learn: Microsoft Edge release schedule – Edge 152 stable week of Aug 27, 2026
- • Microsoft Edge Blog: Faster updates, enterprise-friendly schedule – the new Edge release cycle (Jun 11, 2026)
- • MWPro: MC1187682 – Edge adds Copilot summarization and contextual grounding (updated Aug 28, 2026)
- • MWPro: MC1461152 – PowerPoint adds Copilot skill to create interactive slides on Windows and Mac (updated Aug 28, 2026)
This article was compiled with AI assistance for research and drafting and has been editorially reviewed. All sources are listed above.