Threat Analysis: Manchester Airports Breach, TerminalFix Campaign, and the Defender False-Alarm Problem
Hello, Mauven here.
This is your Daily Threat Analysis for 31st August 2026.
Three stories today. One is a confirmed UK breach that is larger than the organisation initially admitted. One is a campaign that is deliberately engineered to bypass everything you have told your staff to watch out for. And one is a situation where a major platform vendor is actively training users to dismiss their own security alerts. None of them are theoretical.
Manchester Airports Group: What the Initial Statement Left Out
FulcrumSec, a threat actor that has appeared on the breach landscape in recent months, is claiming it stole 86 GB of data from Manchester Airports Group. MAG operates Manchester, East Midlands, and London Stansted airports, three of the higher-footfall regional airports in the UK.
What makes this worth leading with is not just the claim. BleepingComputer confirmed they independently validated at least one affected traveller’s record from the sample data FulcrumSec published. The records reportedly contain detailed customer, booking, and travel information. The phrase used in the reporting is that the scope goes “beyond what MAG initially disclosed.”
That last part is the part that should concern you.
Organisations in breach situations have strong structural incentives to minimise initial disclosures. This is not a cynical observation, it reflects the reality that at the point of first statement, legal, communications, and technical teams are all still trying to understand what has happened. But the gap between what was initially disclosed and what the validated samples appear to show is a gap that affected individuals and downstream businesses need to factor into their own response.
If your business processes bookings or corporate travel through MAG airports, or if any of your staff travelled through those airports in the relevant window, the data now apparently in circulation could include names, booking references, contact details, and travel itineraries. That is a useful set of data for targeted phishing. An attacker who knows your CEO flew to Frankfurt on a specific date and has their email address has a head start on a convincing pretexting campaign.
What to do right now:
- If you are a MAG customer or have corporate accounts linked to those airports, monitor the ICO’s breach register and watch for direct notification
- Brief staff, particularly those in finance, HR, or executive roles, that targeted emails referencing real travel details are a current risk
- Check whether your business email compromise controls are up to date; this is exactly the kind of data that gets used to craft convincing impersonation attacks
TerminalFix: When the User Is the Attack Vector
Microsoft published analysis on Friday of a campaign they are calling TerminalFix, described as a variant of the ClickFix technique that has been circulating for the past year or so.
The mechanics are worth understanding because they are deliberately designed to route around the defences most SMBs actually have in place.
The attack chain begins on compromised websites, not in emails. A user visits a legitimate-looking site that has been tampered with. They are presented with a fake Cloudflare CAPTCHA verification overlay. The overlay instructs them to open Windows Terminal and paste a command to “verify” they are human.
If they comply, they have just executed a PowerShell command that initiates a multi-stage infection chain. The analysis describes DLL sideloading via a legitimate Windows binary, steganographic payload extraction, and ultimately the deployment of a reverse tunnel, giving the attacker persistent remote access into the network.
There is no email to filter. There is no attachment to quarantine. The user opens a legitimate application and types the malicious code themselves, because a webpage told them to.
This is a meaningful evolution. ClickFix-style attacks have been documented since at least 2024, but the use of Windows Terminal specifically, rather than the Run dialog or PowerShell directly, is notable. Windows Terminal looks like a developer tool. It carries an implicit legitimacy for non-technical users who see it as something that IT uses. That perception is being weaponised.
The NCSC has published guidance on social engineering and on the risks of users executing arbitrary code. The fact that this technique is now being deployed at scale against organisations tells you everything about how consistently that guidance is being applied at the end-user level.
What to do right now:
- Brief all staff, not just technical staff, that any webpage asking them to open a terminal or command prompt and paste something is an attack. Full stop. There is no legitimate IT process that requires this of a non-technical user visiting a website
- Consider whether Windows Terminal needs to be accessible to all users, or whether access can be restricted via Group Policy to those who require it
- If you use web filtering, ensure Cloudflare-fronted infrastructure is not treated as implicitly trusted, the legitimate Cloudflare brand is being used to lend credibility to fake overlays
Microsoft Defender: A Self-Inflicted Alert Fatigue Problem
This one is shorter but it matters.
Microsoft has confirmed that the latest Defender Antivirus update is causing systems to display “Antivirus is turned off” alerts incorrectly. The antivirus is apparently still running. The status reporting is broken. Microsoft’s advice, as reported by BleepingComputer, is for users to ignore the alerts while a fix is developed.
I will give you a moment to consider how that plays out at the end-user level.
You have spent time and money, or at least effort, training staff to take security alerts seriously. You may have a process where staff report unexpected Defender alerts to IT or to their managed service provider. Microsoft has now published guidance that tells the average Windows user that a prominent security warning is a false alarm and can be safely ignored.
Attackers are entirely aware that Defender alerts generate this kind of noise. If a piece of malware genuinely disables Defender on a machine this week, the alert it generates looks identical to the false positive Microsoft just told everyone to disregard. That is a meaningful window of opportunity.
This is not a reason to panic. But it is a reason to ensure that your IT support function, whether internal or external, is explicitly monitoring Defender status through management tooling rather than relying on user-reported alerts for the duration of this issue. Do not let “ignore the antivirus warning” become normalised behaviour on your estate.
Context: Infostealer Session Theft Is Broader Than One Platform
One additional item worth a brief mention: Anthropic has confirmed that infostealer malware has been stealing active Claude session tokens from infected machines, allowing attackers to access accounts and consume API usage. The mechanism, stealing live session cookies rather than passwords, is the same technique used against Google, Microsoft, and other platform sessions.
The Claude-specific angle is less important than the general principle it illustrates: if any device on your network is infected with an infostealer, every authenticated session on that device is potentially compromised. This includes corporate Microsoft 365, Google Workspace, banking portals, and any SaaS tool with a persistent login. Password resets do not fix this. The session token is valid regardless of what password is set. Only session revocation, logging out all active sessions, closes the gap.
If you have a suspected infostealer infection, ensure your incident response includes forcing sign-out of all active sessions across every platform the affected user accessed, not just resetting their password.
Sources
Before the next story: if Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it along to someone who needs the heads-up. There are a lot of people running UK businesses right now who have not heard about Manchester Airports yet. That is a gap worth closing today.