When the User Becomes the Exploit – Random Bits of Knowledge

Abstract

The 2026 cyberattack on Berlin’s administration and the disclosure of the WeWorm zero-click WeChat exploit expose two fundamentally different routes into a system. TerminalFix uses adversarial information to induce a legitimate user to cross a consequential execution boundary; WeWorm reaches vulnerable software processing without requiring a deliberate human action. The two mechanisms should not be conflated, but after initial compromise they converge on the same architectural problem: how much authority does the compromised execution context inherit, and which independent boundaries remain between that context and an unacceptable institutional consequence?

This article develops the concept of the human attack surface as the subset of security-relevant interfaces and state transitions in which attacker-controlled information must be interpreted by a human before the system performs a consequential action. On that basis, it argues that human error should be treated as an expected systems failure mode rather than as the root explanation for an incident. Authentication, awareness training, and phishing-resistant interfaces can reduce the probability of some attacks, but they cannot establish user intent, eliminate software exploitation, or determine the blast radius after a boundary has already failed.

Generative AI makes this distinction more consequential primarily by changing attacker economics. Evidence from automated spear-phishing research suggests that reconnaissance, personalization, translation, and message variation can be produced at substantially lower marginal cost, while the WeWorm disclosure provides an early case study of AI-assisted vulnerability research without establishing general autonomous exploit development. The appropriate defensive response is therefore error-tolerant security architecture: constrain execution, privilege, identity, data entitlement, network reachability, egress, and supplier-derived risk; detect causal post-compromise behavior; and preserve rapid containment and recovery. Cybersecurity maturity is consequently measured not only by how often initial compromise is prevented, but by how little additional authority a successful compromise is allowed to acquire.

TerminalFix and WeWorm expose two complementary paths to compromise: one recruits legitimate human authority, while the other removes human interaction entirely. Their convergence shows why cybersecurity must reduce inherited authority and make initial compromise survivable as generative AI lowers the cost of adversarial experimentation.

A CAPTCHA that was not a CAPTCHA

The decisive moment in many intrusions does not resemble exploitation. It resembles work. A user sees a familiar verification interface, receives a short sequence of instructions, and follows them because the procedure appears to be an ordinary prerequisite for reaching a website. No password need be stolen at that moment; no browser memory-corruption bug need be triggered. The attack succeeds because the computer permits its legitimate operator to perform an operation whose meaning has been supplied by an adversary.

That distinction matters for understanding the cyberattack that affected parts of Berlin’s administration in August 2026. Berlin initially disclosed an ICT security incident affecting administrative systems and isolated affected Senate administrations from the state network while forensic investigation proceeded.¹ Subsequent official updates confirmed that data had been exfiltrated before the isolation of the affected infrastructure, while the Rhysida ransomware group later claimed responsibility and asserted that it had obtained approximately 5.7 terabytes of data.² ³ After stolen material was published, Berlin established a central steering unit to coordinate the response across affected authorities.⁴

The most important question for this article is how the first boundary was reportedly crossed. German reporting, citing a warning from the Federal Office for Information Security, linked the Berlin incident to TerminalFix, a ClickFix variant in which a victim is presented with a counterfeit verification procedure and instructed to paste an attacker-supplied command into a terminal.⁵ The BSI advisory described an unnamed German state institution; the Berlin-specific linkage was made through subsequent BSI communication and reporting. It should therefore remain an attributed incident linkage rather than be presented as though the advisory itself were a complete Berlin forensic report.

Microsoft, independently of the Berlin investigation, documented a TerminalFix campaign on 28 August 2026. In Microsoft’s observed chain, a compromised website displayed a counterfeit Cloudflare Turnstile interface; interaction with the page placed a malicious PowerShell command on the user’s clipboard, while the instructions directed the user to open Windows Terminal or PowerShell and execute it.⁶

The browser did not need permission to launch arbitrary malware directly. It needed something easier: the user. More generally, this exposes the human attack surface: the subset of security-relevant interfaces and transitions in which attacker-controlled information must be interpreted by a human before the system performs a consequential action. The relevant unit is not the person but the human-mediated state transition: adversarial information reaches a legitimate user, the user interprets it, and the resulting action causes, authorizes, or enables a change in system state.

TerminalFix occupies one specific part of that surface: a human-mediated execution transition. The attacker uses a deceptive workflow to move from untrusted web content to local command execution. Other human-mediated transitions need not involve code execution at all; they can include approving authentication requests, granting application consent, authorizing remote access, changing payment details, releasing information, or modifying trust relationships.

A conventional account of phishing emphasizes deception, and deception is certainly present, but the more precise systems description is:

untrusted content supplies an interpretation of what should happen;
a legitimate user accepts that interpretation;
the user invokes an interface with consequential authority;
the system accepts the resulting action under the user’s legitimate context;
attacker-selected intent is converted into a security-relevant state transition.

This is not equivalent to saying that users are intrinsically unreliable. It says that an architecture can expose a dangerous interface whenever it assumes that a correctly authenticated human necessarily understands the provenance and consequence of every operation that the interface allows.

TerminalFix is therefore more than a phishing technique. It is a method for converting human authority into code execution. Authentication can establish who invoked an operation; it does not establish whose objective the operation serves. A PowerShell process can be launched by the correct employee, from the correct workstation, during a legitimate session, while still implementing the attacker’s intent.

That is also why the Berlin case should not be reduced to the retrospective observation that someone should not have pasted a command. Even if that observation is factually correct, it does not explain why one mistaken action could become the beginning of an intrusion with consequences measured at institutional scale.

The relevant causal chain continues after the user acts.

From one pasted command to a network foothold

Microsoft’s TerminalFix analysis provides an unusually clear reconstruction of what can happen after the human has already crossed the execution boundary. The chain is useful as a technical model, although Microsoft’s publication does not establish that every stage it observed occurred in the Berlin environment.⁷

The browser only has to win once

In the campaign analyzed by Microsoft, the compromised webpage displayed a fake Cloudflare verification overlay. The victim was instructed to perform the equivalent of a verification procedure, but the action actually executed an attacker-controlled PowerShell command.⁸

The command downloaded an archive, extracted its contents beneath C:\ProgramData, and launched a batch file; reassuring output was printed to the terminal so that malicious activity resembled successful verification.⁹ The user therefore supplied only the first transition. Subsequent stages were automated.

Across the diagrams in this article, solid arrows denote attack or state transitions, dotted arrows denote defensive constraints, interruption, or observability, and thick arrows denote plausible progression beyond what was directly observed or demonstrated in the cited case.

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Compromised<br/>website] --> B[Fake verification<br/>interface]
    B --> C[Human interprets attacker instruction<br/>as legitimate procedure]
    C --> D[User-triggered Terminal<br/>or PowerShell execution]

    D --> E[Attacker-controlled execution<br/>in user context]
    E --> F[Signed loader +<br/>malicious DLL sideload]
    F --> G[Payload reconstruction<br/>from PNG data]

    G --> H[Persistence]
    G --> I[AD + host<br/>reconnaissance]
    G --> J[Asynchronous<br/>command interface]

    H --> K[Persistent compromised endpoint<br/>with mapped environment + remote control]
    I --> K
    J --> K

    K --> L[Python reverse<br/>WebSocket tunnel]
    L --> M[Arbitrary TCP proxy<br/>through victim host]
    M --> N[Endpoint network position becomes<br/>attacker-usable reachability]

    N ==> O[Possible additional<br/>internal access]
    O ==> P[Possible credential exposure<br/>or lateral movement]
    P ==> Q[Possible exfiltration<br/>or ransomware]

Figure 1: TerminalFix converts one human-mediated execution decision into a persistent endpoint capability and then into attacker-usable network reachability. Thick arrows mark downstream effects that Microsoft described as possible but did not observe in the analyzed chain.

Figure 1 separates observed stages from plausible later consequences because Microsoft explicitly stated that it did not observe the downstream lateral movement, privilege escalation, exfiltration, or ransomware activity described as possible follow-on behavior.¹⁰

Legitimate software becomes an execution substrate

A notable stage in the chain was DLL sideloading. The downloaded archive contained LockScreenContentServer.exe, a legitimate signed Windows binary, together with a malicious DLL named dui70.dll. When the legitimate executable started, Windows library resolution caused it to load the attacker-controlled DLL placed alongside it.¹¹

DLL sideloading is important because the existence of a valid signature on the executable does not make the execution context benign. Signing identifies software provenance; it does not guarantee that every library loaded by the signed process is legitimate, nor does it prove that the process has been invoked for its intended purpose.

The malicious component then retrieved PNG files from attacker-controlled infrastructure and extracted concealed binary material from image data, reassembling further payloads on disk.¹² The technique is another example of why detection cannot rely exclusively on superficial file type or process reputation: image files can be delivery containers, and trusted executables can become loaders.

Persistence changes an event into a foothold

Initial execution is transient unless an attacker can retain access. Microsoft’s chain therefore established persistence through both a Registry Run key and scheduled tasks that relaunched the malicious execution path periodically.¹³

Persistence changes the defensive problem. The question is no longer whether a user executed one malicious command; it is whether the resulting state survives logoff, restart, process termination, or partial cleanup.

The malware also conducted Active Directory and network reconnaissance, including domain trust discovery, enumeration of domain administrators and users, system-information collection, and attempts to identify reachable servers.¹⁴ Such activity converts a compromised endpoint into a source of information about the surrounding organization.

The workstation becomes a proxy

The chain culminated in deployment of an embeddable Python runtime together with a custom tunnelling client. The client initiated an outbound encrypted WebSocket connection to attacker infrastructure and could relay arbitrary TCP connections through the compromised machine.¹⁵

A reverse tunnel is important because the connection originates from inside the victim environment. Traditional perimeter reasoning often concentrates on blocking unsolicited inbound access, but an attacker who can initiate an outbound connection from an endpoint can create a path back into services reachable from that endpoint’s network position. The endpoint thereby becomes a network pivot: an intermediary from which an attacker can attempt to reach systems that are not themselves exposed to the public Internet.

The technical sequence changes the interpretation of the initial user action. The user did not consciously authorize Active Directory reconnaissance, persistence, command-and-control, or network proxying; the user authorized one command whose subsequent behavior was not meaningfully visible at the decision point. That asymmetry is the essence of the attack. A small, plausible human action can inherit the full expressive power of a general-purpose execution environment.

Yet TerminalFix still requires a successful act of persuasion. The complementary case asks what happens when the exploitation boundary can be crossed without the victim deciding anything at all.

WeWorm: the complementary zero-click attack surface

On 8 September 2026, Calif Research disclosed WeWorm, a proof of concept targeting WeChat calls across iOS and Android.¹⁶ Calif described it as a zero-click worm: calling a victim could trigger exploitation through automatically processed call data, after which the compromised context could place malicious calls to additional trusted contacts.¹⁷

Where TerminalFix converts a human decision into attacker execution, WeWorm attempts to remove the human decision entirely.

A compromised victim can become the next attacker

Calif’s demonstration used an Android Pixel device to call an iPhone, compromise the iPhone while it was ringing, and then use the compromised iPhone to call and compromise another Android device.²⁰

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Attacker-controlled<br/>WeChat account] --> B{Callable friend<br/>relationship exists?}
    B -->|No| X[No WeWorm path<br/>to this target]
    B -->|Yes| C[Malicious<br/>WeChat call]

    C --> D[Automatic VoIP processing<br/>before deliberate interaction]
    D --> E[Memory-corruption<br/>exploit]
    E --> F[WeChat RCE +<br/>account control]

    F --> G[Inherited relational authority:<br/>messages, calls + trusted contacts]
    G --> H{Another trusted<br/>contact callable?}
    H -->|No| Y[Propagation stops<br/>on this branch]
    H -->|Yes| I[Malicious call from<br/>compromised trusted account]
    I --> J[Automatic VoIP processing<br/>on next device]
    J --> K[Next WeChat<br/>context compromised]
    K ==> G

    L[Decline incoming call] -. interrupts this attempt .-> D
    M[Client or server-side mitigation] -. removes exploitable transition .-> E
    M -. removes exploitable transition .-> J

Figure 2: WeWorm converts application compromise into relational authority: after RCE, the compromised WeChat account can originate the next malicious call inside the trust graph. The solid path represents the mechanism demonstrated across three devices; the thick return edge denotes propagation beyond that demonstration.

A worm, in this context, is code whose successful compromise of one target provides a mechanism for initiating compromise of additional targets without separate manual deployment at each hop.

The social graph becomes part of the propagation mechanism. Calif notes that the attacker must be able to call the target under WeChat’s relationship and calling constraints, so the attack is not equivalent to indiscriminate unauthenticated Internet scanning.²¹ Nevertheless, compromise of a trusted account can change the attacker’s position because subsequent malicious calls originate from an account already connected to other users.

This creates a form of trust propagation: the first exploit changes not only control of one application context but also which relationships the attacker can traverse.

Demonstration is not population-scale evidence

Calif argues that the vulnerability could have endangered more than a billion users or accounts because of WeChat’s scale.²² That statement is a risk projection, not an experiment demonstrating billion-device propagation.

The public proof of concept used three devices. It demonstrated cross-platform propagation in a constrained chain; it did not establish epidemic dynamics, a real-world reproduction number, or the ability to compromise every reachable WeChat installation.

Cross-platform propagation also does not imply that Android and iOS were exploited through identical low-level mechanisms. Calif reports successful RCE on both platforms, but the technical details necessary to compare exploit chains have not been published.

The demonstrated impact should likewise be stated carefully. Calif describes hijacking WeChat and propagating through the application, but the public material does not justify treating that as equivalent to unrestricted compromise of the entire operating system on every target.²³

The disclosure timeline matters

According to Calif, the team identified the underlying vulnerability in July 2026, notified Tencent on 24 July, achieved Android remote code execution by 30 July and iOS remote code execution by 2 August, completed a polished worm demonstration by 11 August, and observed mitigated Android and iOS client releases on 21 August. Calif says Tencent later deployed a server-side mitigation covering users regardless of local client version on 28 August, received technical analysis and working exploits on 3 September, and confirmed remote-code-execution impact on 4 September.²⁴ ²⁵

Tencent’s Security Response Center publicly treats WeChat client remote-code-execution vulnerabilities as an in-scope, high-value vulnerability class within its research program, although no WeWorm-specific Tencent technical advisory was located for this article.²⁶ The mitigation timeline therefore remains supported primarily by Calif’s disclosure.

The case contains another detail relevant to the later AI argument. Calif says an AI-assisted research process helped the team find the bug and reach its first RCE in roughly two days, while development of the worm followed over approximately another week.²⁷ That is a self-reported case study rather than a controlled measurement of AI-assisted exploit-development productivity, so it should not be generalized into a universal multiplier.

Even with those limitations, the conceptual contrast with TerminalFix is strong:

TerminalFix: attacker-controlled content → persuasive instruction → consequential human action → local execution.
WeWorm: attacker-controlled call → automatic protocol processing → memory corruption → local execution.

One attack exploits interpretation; the other exploits implementation. Both eventually ask the defender the same question: what authority does the compromised context inherit?

The human attack surface is a systems problem

Calling users the weakest link compresses several different failure mechanisms into one moralized metaphor. It treats susceptibility as a property of people while hiding the systems that determine which decisions people must make, which authority those decisions exercise, and what consequences follow when one decision is wrong.

A more useful principle is that reliable human suspicion should not be a primary control for operations whose failure can produce disproportionate organizational consequences.

Security is rarely the user’s primary task

NIST’s phishing research treats susceptibility as context-dependent rather than as a fixed trait, examining how observable message characteristics interact with the recipient’s user context.²⁸ The NIST Phish Scale similarly evaluates detection difficulty through both observable cues and premise alignment: how well the message fits the recipient’s role, responsibilities, expectations, and context.²⁹

That distinction is important because security decisions often interrupt another task. The person targeted by TerminalFix is not primarily solving a malware-analysis problem. The person is trying to reach a webpage. To reject the lure correctly, the user may need to infer that:

the verification workflow is unusual;
a browser should not normally require terminal execution;
clipboard contents are attacker-controlled data;
PowerShell can perform consequential system operations;
polished branding is not evidence of provenance;
successful completion of a workflow does not establish its legitimacy.

Security professionals recognize this sequence because they possess specialized knowledge. Requiring every employee to reproduce the same analysis consistently across every unfamiliar workflow is a very different control proposition.

Training can improve performance, and NIST does not argue otherwise. The limitation is that training cannot make contextual classification deterministic.

Attackers need a success; defenders face a distribution

The attacker and defender operate under different optimization conditions. An organization has many employees, roles, workloads, suppliers, time pressures, communication channels, and exceptional circumstances. The attacker can try multiple messages, vary framing, choose targets, and learn from failure.

The resulting asymmetry is simple:

the defender attempts to keep a large distribution of human decisions safe;
the attacker searches that distribution for a sufficiently favorable decision;
one successful decision may be enough to create an initial foothold.

The security objective should therefore contain two independent goals:

reduce the probability that deception succeeds;
reduce the maximum consequence when deception succeeds.

Awareness addresses mainly the first. Architecture determines much of the second.

The decisive variable is inherited authority

TerminalFix and WeWorm appear opposite because one requires a user and the other does not, but their effects converge after initial exploitation.

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Adversarial<br/>content] --> B[Human<br/>interpretation]
    B --> C[User-triggered<br/>execution]

    D[Adversarial<br/>network input] --> E[Automatic application<br/>processing]
    E --> F[Vulnerable<br/>execution]

    C --> G[Compromised<br/>execution context]
    F --> G

    G --> H[Identity +<br/>credentials]
    G --> I[Local<br/>privileges]
    G --> J[Persistence]
    G --> K[Internal-service<br/>reachability]
    G --> L[Information<br/>access]
    G --> M[Trusted<br/>relationships]

    H --> N{Independent boundaries<br/>remain effective?}
    I --> N
    J --> N
    K --> N
    L --> N
    M --> N

    T[Authorization + containment<br/>architecture] -. constrains .-> N

    N -->|Yes| O[Localized<br/>incident]
    N -->|No| P[Expanded<br/>compromise]
    P --> Q[Lateral movement]
    P --> R[Data exposure]
    P --> S[Operational disruption]

Figure 3: Human-mediated and zero-click initial access converge on the same systems question: how much authority the compromised execution context inherits, and which independent boundaries remain effective afterward.

Figure 3 distinguishes compromise probability from compromise consequence. These variables are related, but they are not interchangeable.

A persuasive message can increase the probability that initial access succeeds. Broad local privilege, weak segmentation, excessive data entitlement, reusable credentials, and unrestricted egress can increase the consequence of that success. Blaming the initial user collapses those different variables into one.

Human error should be treated as an expected failure mode

NIST researcher Julie Haney has criticized security approaches that implicitly characterize users as liabilities while failing to account for the usability and organizational conditions under which security behavior occurs.³⁰ The stronger systems inference is that plausible human error should be modeled similarly to other expected failure modes.

An intrusion can be represented as a series of dependent transitions:

attacker constructs a plausible deception;
organizational workflow exposes a user to it;
the user makes a plausible unsafe decision;
the endpoint accepts the resulting operation;
privileges and connectivity permit further activity;
subsequent controls fail to stop progression;
organizational impact occurs.

Training addresses one transition. It does not determine the others.

The chain metaphor itself is imperfect because enterprise defenses are networks of partially independent controls rather than one-dimensional sequences. CISA and NSA guidance on common enterprise misconfigurations emphasizes privilege restriction, monitoring, and security by design, while CISA’s ransomware guidance combines identity controls, application allowlisting, EDR, segmentation, backup strategy, and containment.³¹ ³²

The correct question is therefore not which link is weakest? but which combinations of failures permit an unacceptable outcome?

Authentication solves only part of the problem

Phishing-resistant authentication, particularly FIDO/WebAuthn-based approaches, materially reduces classes of credential-replay attack and should be preferred for important accounts where practical.³³

TerminalFix demonstrates a different problem. The user can already be authenticated correctly. The attack manipulates what the authenticated user is trying to accomplish.

This yields a critical distinction:

identity verification: is this the legitimate user?
intent verification: does this action serve the legitimate user’s actual objective?

Computers are comparatively good at the former. The latter is much harder because attackers can manipulate the context in which humans form intent.

As authentication improves, adversaries can move upward in abstraction: session theft, malicious consent, remote-management installation, authorization manipulation, command execution, support impersonation, and other techniques that exploit legitimate authority after identity has already been established. Users remain part of the security system, and they can be highly effective defenders, but they should not be its fuse.

The architectural assumption should be that some persuasive attacks will eventually succeed. Generative AI makes that assumption more important because persuasion itself is becoming cheaper to produce, personalize, translate, vary, and test.

Generative AI changes the economics of social engineering

The most consequential effect of generative AI on social engineering is economic rather than literary. Attackers have always been able to write convincing messages. What changes when models automate parts of reconnaissance, drafting, translation, personalization, and variation is the marginal cost of producing another plausible attack.

Traditional phishing exhibited a rough trade-off:

mass phishing was inexpensive but generic;
spear phishing was specific but labor-intensive.

Generative AI weakens that distinction.

From mass phishing to mass personalization

Heiding, Lermen, Kao, Schneier, and Vishwanath tested automated personalized phishing against human subjects in a 2024 preprint involving 101 participants.³⁴ Their generic phishing condition produced a 12% click-through rate; messages prepared by human experts produced 54%; fully AI-automated personalized messages also produced 54%; and AI-assisted messages with a human in the loop produced 56%.

Those percentages should not be generalized beyond the study’s participants, delivery conditions, prompts, models, and measurement procedure. The more important observation is that, in that experimental setting, automation produced individualized phishing that performed comparably to manually prepared expert messages.

The system also automated information gathering and creation of personalized vulnerability profiles. The researchers reported that gathered information was useful and accurate in 88% of cases, while 4% of profiles contained inaccurate information.³⁵

Microsoft’s 2025 Digital Defense Report cited the study while discussing the declining cost and increasing scalability of phishing; it also repeated the paper’s modeled estimate that AI-enabled campaigns could become as much as fifty times more profitable for sufficiently large target populations.³⁶ That figure is a model-dependent projection, not an observed universal multiplier.

The scarce resource moves from writing to access

As text generation becomes cheap, the bottleneck migrates. A machine-assisted phishing workflow can increasingly automate or accelerate:

collecting names, roles, suppliers, technologies, and current organizational events;
inferring plausible pretexts from public information;
adapting vocabulary to a profession or department;
translating messages while preserving tone;
producing multiple stylistic variants;
generating follow-up messages;
reformatting the same objective for email, messaging, web, or voice workflows.

The attack still needs delivery infrastructure, trusted or compromised accounts, domains, target information, evasion, initial access, and eventual monetization. Generative AI does not remove those constraints.

It changes how attacker labor is allocated. ENISA’s 2025 Threat Landscape reported that phishing, including vishing, malspam, and malvertising, accounted for approximately 60% of observed initial-intrusion cases in its reporting dataset, while vulnerability exploitation accounted for another substantial share.³⁷ ENISA also described threat actors using commercial, modified, or otherwise adapted large language models for social engineering, reconnaissance, persona construction, and malicious-tool development.

The report stated, based on external reporting, that AI-supported phishing had come to represent more than 80% of observed social-engineering activity in some worldwide assessments by early 2025.³⁸ Because ENISA was synthesizing external evidence rather than reporting a complete global census, that figure should remain qualified.

Personalization attacks context, not intelligence

A high-quality social-engineering message does not need to make the recipient irrational. It needs to make the malicious action locally plausible. The same attacker objective can therefore be wrapped differently:

procurement receives a supplier-registration problem;
finance receives an invoice exception;
developers receive a repository or build-system issue;
administrators receive an account-recovery workflow;
executives receive a legal or governance document;
public officials receive an inter-agency request;
ordinary web users receive a human-verification procedure.

This is where generative systems combine naturally with the premise-alignment problem identified in phishing research. The attacker can produce more versions of the same malicious objective and search for the framing that best fits the target’s working context.

TerminalFix is a good example. The user does not need to believe that running PowerShell is safe in the abstract. The user needs to believe that this particular terminal command is part of this particular verification workflow.

Translation removes another historical friction

Microsoft’s threat reporting identifies translation, automated spear phishing, synthetic personas, and deepfake-assisted social engineering among the ways AI can augment attacker operations.³⁹

Poor grammar and awkward translation have historically been useful phishing cues. They remain useful when present, but they are increasingly weak as a general defense because fluent multilingual generation is inexpensive.

Training that relies heavily on stylistic defects therefore targets a property that attackers can improve cheaply.

Variation attacks signature-based expectations

Generative AI also makes textual polymorphism inexpensive. An attacker can alter:

subject lines;
claimed sender relationships;
urgency;
vocabulary;
explanation order;
business context;
procedural details;
follow-up wording.

That does not make detection impossible. Domain reputation, authentication signals, URL behavior, endpoint telemetry, process ancestry, identity anomalies, and network activity remain valuable precisely because they do not depend entirely on message wording.

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Target information] --> C[Automated<br/>reconnaissance]
    B[Attacker objective] --> D[Target<br/>profiling]
    C --> D
    D --> E[Language + context<br/>adaptation]
    D --> F[Lure<br/>generation]
    D --> G[Message<br/>variation]
    E --> H[Individualized<br/>campaign]
    F --> H
    G --> H

    H --> I[Email]
    H --> J[Messaging]
    H --> K[Voice]
    H --> L[Web interaction]

    I --> M{Recipient outcome}
    J --> M
    K --> M
    L --> M

    M -->|no success| G
    M -->|success| N[Credential theft]
    M -->|success| O[Authorized command<br/>or tool execution]
    M -->|success| P[Account takeover]
    M -->|success| Q[Malware delivery]

    R[Infrastructure + access<br/>+ evasion + monetization] -. constrains .-> H
    R -. constrains .-> N
    R -. constrains .-> O
    R -. constrains .-> P
    R -. constrains .-> Q

Figure 4: Generative AI reduces the marginal cost of producing and adapting individualized social-engineering attempts, while infrastructure, access, evasion, and monetization remain independent constraints.

Figure 4 captures the important shift: personalization can become a property of mass campaigns rather than a privilege of a small number of high-value operations.

Generative AI also changes throughput outside phishing

The WeWorm disclosure points toward another domain. Calif reports that AI assistance contributed to vulnerability discovery and rapid development of initial remote-code-execution exploits.⁴⁰

That case should not be exaggerated. The public evidence reviewed here does not establish that general-purpose models can autonomously discover and reliably weaponize arbitrary vulnerabilities on demand; exploit development still depends on target-specific expertise, debugging, testing, platform knowledge, mitigation bypasses, and operational judgment.

The important variable is throughput.

If an expert can use machine assistance to inspect more code, generate more hypotheses, transform documentation faster, or automate repetitive analysis, the cost of exploration can fall even when human expertise remains indispensable.

The two attack classes may therefore be amplified differently:

TerminalFix-like path: lower persuasion cost → more targeting and variation → more opportunities for human-mediated execution.
WeWorm-like path: lower research and analysis cost → more vulnerability hypotheses and exploit-development assistance → more opportunities for low- or zero-interaction compromise.

Microsoft and ENISA threat intelligence describe both directions: AI-assisted social engineering on one side, and AI-assisted reconnaissance, vulnerability research, tooling, and intrusion operations on the other.⁴¹ ⁴²

Scale turns small probabilities into institutional risk

When the marginal cost of another attempt is high, low-probability attacks may be uneconomic. When the marginal cost falls, the same probability can become attractive at scale.

Generative AI can exert two simultaneous pressures:

more attempts, because content and reconnaissance are cheaper;
more targeted attempts, because personalization is cheaper.

The combination resembles spear phishing without the traditional requirement that every message be handcrafted. Phishing-as-a-Service already industrializes infrastructure, templates, credential collection, and campaign logistics; generative systems add another production layer rather than creating cybercrime industrialization from nothing.⁴³ ⁴⁴

The dangerous assumption is therefore not that AI makes persuasion irresistible. It is that persuasion will remain scarce. A security architecture designed on the expectation that only a few high-quality social-engineering attempts will reach employees can become brittle when personalized attempts become cheap enough to test continuously.

The defensive problem shifts accordingly: some messages will work, so successful persuasion must become survivable.

From security awareness to error-tolerant security architecture

An error-tolerant security architecture is designed so that plausible failure of a user, endpoint, application, identity, supplier, or individual preventive control does not automatically propagate into broad identity, network, data, or operational compromise. Its governing objective contains two terms:

reduce the probability of compromise;
reduce the consequence of compromise.

Security awareness remains part of the first. The rest of the architecture determines whether one successful lure becomes an institutional breach.

Break the chain after the user has already failed

A TerminalFix-like chain contains multiple intervention points after the malicious command has started.

Application policy can constrain arbitrary execution. Endpoint detection can observe suspicious process ancestry. Persistence can be monitored. Outbound command-and-control can be restricted or detected. Segmentation can reduce internal reachability. Least-privilege identity can limit inherited authorization. Sensitive resources can impose their own access conditions.

CISA’s ransomware guidance recommends application allowlisting, endpoint detection and response, network segmentation, identity controls, and other independent mitigations precisely because ransomware resilience cannot depend on a single preventive boundary.⁴⁵

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Successful<br/>deception] --> B[Payload<br/>execution]
    B --> C[Persistence]
    C --> D[Reconnaissance]
    D --> E[Outbound<br/>tunnel]
    E --> F[Internal<br/>systems]
    F --> G[Sensitive<br/>resources]

    H[Application control +<br/>restricted scripting] -. blocks or constrains .-> B
    I[EDR + behavioral<br/>detection] -. observes .-> B
    J[Persistence<br/>monitoring] -. observes .-> C
    K[Egress controls] -. constrains .-> E
    L[Segmentation] -. constrains .-> F
    M[Least-privilege<br/>identity] -. limits authority at .-> F
    N[Resource-level<br/>authorization] -. limits .-> G
    O[Prepared<br/>containment] -. can interrupt .-> C
    O -. can interrupt .-> E
    O -. can interrupt .-> F

Figure 5: Independent controls act on different transitions after a TerminalFix-like deception has already succeeded, reducing the probability that local execution progresses to sensitive-resource compromise.

The central design rule in Figure 5 is simple: initial human error should count as one failed control, not as permission for the remainder of the attack path.

General-purpose interpreters deserve explicit policy

PowerShell is not malicious software. It is a legitimate, powerful administrative and automation environment, which is precisely why adversaries value it.

Blanket removal is often impractical and can damage legitimate administration. The better question is which users, devices, and workflows require which levels of PowerShell capability.

Microsoft’s Application Control for Windows can govern executables, scripts, installers, batch files, and PowerShell behavior rather than treating script execution as an unbounded default.⁴⁶ Under enforced App Control, trusted PowerShell code can run with full language capabilities while untrusted code can be constrained.⁴⁷ Current policy options can further restrict direct commands and require explicitly permitted script files; Microsoft’s FileOnlyEntry setting provides this model on supported PowerShell versions, including PowerShell 7.6.6 and later.⁴⁸

The general principle extends beyond PowerShell: administrative capability should be exposed through the narrowest interface compatible with legitimate work.

Signing is not the same as trust

TerminalFix’s DLL-sideloading stage used a legitimate signed executable.⁴⁹ That makes a broader point about control design. A valid signature answers a provenance question about a file. It does not establish that:

the process was launched for a legitimate purpose;
every loaded library is trustworthy;
the working directory is expected;
the process ancestry is benign;
subsequent file or network behavior is normal.

Application control and behavioral EDR therefore solve different problems and should be treated as complementary rather than interchangeable.

Outbound traffic is part of the perimeter

The reverse tunnel in Microsoft’s analysis initiated an outbound TLS connection on port 443.⁵⁰ A security model that concentrates only on unsolicited inbound connections can therefore leave a major path unexamined.

Egress governance need not mean crude universal allowlists. Different endpoint classes can have different requirements, but the organization should know:

which devices require direct Internet access;
which servers require which external destinations;
whether DNS and web traffic are monitored;
whether unusual long-lived encrypted sessions are visible;
whether interpreters and newly launched executables initiate network connections;
whether privileged administration environments require Internet access at all;
whether abnormal destination or transfer patterns trigger investigation.

Outbound connectivity is an authority granted to software. It should be governed as such.

Network location should not confer broad authority

NIST SP 800-207 defines zero-trust architecture around protection of resources rather than implicit trust derived from network location.⁵¹

That principle directly addresses network pivoting. A compromised employee workstation should not acquire broad access merely because it resides inside an enterprise address space. Internal services should continue making decisions from identity, device condition, service policy, resource sensitivity, and explicit authorization.

Segmentation remains useful, but segmentation and zero trust are not synonyms. Segmentation constrains reachability; resource-oriented authorization constrains what a reachable client is allowed to do. Both reduce blast radius.

Least privilege must include data, not only administrators

Least privilege is often interpreted as restricting local administrator or domain administrator rights. Those controls are important, but ordinary identities can still possess large legitimate data entitlements.

An attacker who compromises a non-administrative account may inherit access to years of email, document repositories, collaboration platforms, case-management systems, source code, customer records, or internal knowledge.

Data authorization should therefore ask:

which repositories are necessary for the current role;
whether stale permissions expire;
whether bulk retrieval is detectable;
whether highly sensitive repositories require stronger access conditions;
whether service accounts receive narrowly bounded data access;
whether privileged administrative identities are separated from ordinary communication and browsing identities.

Authorization has a blast radius even when no administrator credential is involved.

Identity must remain useful after one session is compromised

Phishing-resistant MFA substantially raises the cost of credential replay, but it cannot make an already authenticated hostile endpoint trustworthy.⁵²

Identity architecture therefore needs controls that remain meaningful after session compromise: short-lived credentials, conditional access, separate privileged identities, restricted administrative workstations, device-bound authentication where appropriate, rapid session revocation, and explicit authorization for highly consequential operations. Authentication proves identity at a point in time.

It does not continuously prove benign intent.

Detection should follow causal sequences, not only known malware

TerminalFix also illustrates why post-compromise detection can be more durable than lure recognition. The lure can change its language, branding, and story. The operational chain still needs to do things:

launch an interpreter;
retrieve or assemble code;
establish persistence;
enumerate systems or identities;
open command-and-control;
use credentials;
read data;
traverse boundaries.

The lure can vary nearly without limit. Persistence still has to persist. A tunnel still has to communicate. Credentials still have to be used. Data still has to be read. Exfiltration still has to cross a boundary.

Endpoint, identity, and network telemetry should therefore be correlated around causal sequences and high-consequence behaviors rather than only around known malware hashes or phishing text.

Rapid containment is a design capability

Berlin’s initial response included isolating affected administrations from the state network while investigation proceeded.⁵³ Isolation is not merely an incident-management choice; the ability to isolate rapidly depends on architecture created beforehand.

Organizations should be able to:

isolate an endpoint;
constrain or disable an identity;
revoke sessions and credentials;
block identified command-and-control;
segment or disconnect affected environments;
preserve relevant evidence;
reconstruct recent reachability and data access.

Containment capability deserves the same design attention as prevention.

Security friction should be concentrated where consequences are high

Restrictive controls have operational costs. Application allowlisting can impede development workflows. Strong segmentation complicates integration. Reauthentication creates friction. Egress restrictions can interfere with legitimate services.

Security architecture should therefore avoid distributing maximum friction everywhere. A better hierarchy is consequence-sensitive:

low-consequence browsing should require little security ceremony;
unusual code execution should face more constraint;
privileged administration should occur in more restricted contexts;
bulk access to sensitive data should trigger stronger controls;
changes to identity, security policy, payment, or infrastructure should receive explicit authorization and logging.

Good security architecture reduces the number of unnecessary high-stakes decisions imposed on users while adding friction where attacker leverage would otherwise be greatest.

This also changes measurement. A phishing simulation with a low click rate can coexist with catastrophic post-click authority; a higher click rate in an environment that reliably constrains execution and propagation may produce less institutional risk.

The meaningful question is what happens after the simulated user fails.

Designing institutions for machine-scale adversaries

Error-tolerant architecture cannot be delivered by an endpoint team acting alone. Application control depends on which software the organization permits; least privilege depends on job and authorization design; segmentation depends on service architecture; egress control depends on network policy; rapid containment depends on incident authority; supplier security depends on procurement.

If generative AI lowers the cost of adversarial variation, institutions must reduce the amount of cybersecurity that depends on repeated discretionary judgment at the edge of the organization.

A machine-scale adversary need not be an autonomous system independently conducting an entire intrusion. The term is more useful for an adversary whose human operators use automation or generative systems to increase materially the number, diversity, personalization, or speed of adversarial actions they can attempt.

The resulting asymmetry is organizational as much as technical. A defender cannot respond to inexpensive machine-generated variation by proportionally increasing scarce human review.

Cybersecurity governance must own the consequences of human error

The weakest-link framing creates an accountability problem. If incidents are attributed primarily to users, responsibility can migrate downward while authority over the systems that determine incident severity remains elsewhere.

An employee generally cannot decide whether PowerShell runs unrestricted, whether networks are segmented, whether privileged sessions are isolated, whether endpoint telemetry is retained, whether supplier contracts impose security obligations, or whether a sensitive repository grants excessive access.

Those are institutional decisions. Article 20 of the NIS2 Directive requires management bodies of covered essential and important entities to approve cybersecurity risk-management measures and oversee their implementation; Article 21 requires appropriate and proportionate technical, operational, and organisational measures spanning incident handling, continuity, supply chains, secure acquisition, effectiveness assessment, training, access control, and authentication.⁵⁴

The model is significant because it places cybersecurity responsibility where authority exists. A governance body evaluating TerminalFix-like risk should therefore ask:

why ordinary workstations expose particular execution capabilities;
which controls remain after malicious execution begins;
what a compromised identity and endpoint can reach;
how quickly the organization can detect and isolate compromise;
how much sensitive information is accessible before containment;
whether suppliers expose equivalent attack paths;
who has authority to accept the residual risk.

These are governance questions because their answers depend on architecture, staffing, budgets, operational trade-offs, and risk acceptance.

Risk registers should model attack paths, not merely threat labels

High-level categories such as phishing, ransomware, malware, and AI-enabled attack are useful taxonomies, but they are weak descriptions of causality:

Phishing risk does not indicate whether a successful lure yields only a disposable browser session or a workstation with broad access to administrative systems.
Ransomware risk does not reveal whether backup infrastructure shares credentials with production.
AI-enabled attack does not identify which security boundary is threatened.

Risk analysis is more useful when it follows the path:

external adversarial input;
trust or execution boundary crossed;
authority inherited;
systems and data reachable;
independent defensive opportunities;
plausible organizational impact.

Ownership can then be attached to transitions. Endpoint engineering owns some controls, identity teams others, network teams others, business units data entitlement, procurement supplier obligations, and management residual risk. Otherwise every control can have an owner while the complete attack path has none.

Security baselines should reduce local discretion

Machine-scale attack variation favors standardized controls because standardization lets an institution make one security decision and enforce it repeatedly.

If every employee must independently decide whether an unfamiliar shell invocation is safe, the organization repeats a difficult classification problem thousands of times under heterogeneous conditions. If managed policy determines that ordinary office workstations cannot execute unapproved scripts, the organization makes the decision centrally. This does not require homogeneous endpoints. Different roles legitimately need different capabilities:

ordinary knowledge-worker devices can expose a constrained execution surface and no standing administrative privilege;
engineering workstations can expose broader tooling under stronger monitoring and explicit exception policy;
privileged administration environments can minimize browsing and messaging exposure while restricting management destinations.

The exact profiles are organization-specific. The governance principle is: exceptions should be explicit, owned, justified, and reviewed.

Procurement is part of the attack surface

WeWorm demonstrates the complementary dependency. An institution can harden its internal Windows estate and still depend on browsers, messaging applications, mobile operating systems, SaaS platforms, libraries, identity providers, appliances, and managed services developed elsewhere.

A remotely exploitable defect in such a product cannot be corrected by employee awareness. NIS2 includes supply-chain security among cybersecurity risk-management measures, while ENISA’s implementation guidance addresses supplier relationships alongside vulnerability handling, secure acquisition and development, access control, incident handling, human-resources security, and control-effectiveness assessment.⁵⁵

Supplier evaluation should therefore consider:

how vulnerability reports are received and triaged;
how long a product remains supported;
how quickly security fixes reach deployed systems;
whether vulnerable functions can be disabled centrally;
which dependencies materially affect security;
which telemetry customers can obtain;
how compromise is communicated;
whether enterprise policy can constrain dangerous features.

The EU Cyber Resilience Act reinforces the same lifecycle principle for products with digital elements. European Commission guidance emphasizes cybersecurity risk assessment, secure-by-default design, support periods, updates, and vulnerability handling by manufacturers.⁵⁶

The relevant procurement objective is not vulnerability-free software, which is not a credible expectation. It is software whose vulnerabilities can be discovered, constrained, corrected, and communicated efficiently.

Patchability is an architectural property

Calif reports that Tencent first shipped mitigated WeChat client releases and subsequently deployed a server-side mitigation that protected users regardless of local client update status.⁵⁷

That sequence illustrates why remediation speed is itself a security property. Two products with similarly severe vulnerabilities can produce very different risk when one can be mitigated centrally and the other requires manual intervention across thousands of intermittently connected devices.

Architecture and procurement should therefore consider whether:

updates are automatic or discretionary;
updates can be centrally enforced;
dangerous functionality can be remotely disabled;
emergency changes can be rolled back safely;
unsupported versions remain visible in inventory;
affected assets can be identified immediately;
dependency relationships are known.

An inventory that records only a product name but not version, support state, ownership, or dependency context is insufficient for emergency vulnerability management.

Cybersecurity operations need machine-scale triage

More convincing phishing produces more ambiguous reports; more automated reconnaissance produces more events; more variation weakens simple signatures. The defender therefore faces a queueing problem.

Human expertise cannot scale linearly with adversarial events. Automation should absorb repeatable work:

high-volume telemetry collection;
enrichment with asset and identity context;
deterministic correlation;
prioritization by consequence;
bounded automated containment where confidence is high;
escalation of consequential ambiguity to humans.

Generative AI can assist analysts with summarization, translation, query construction, code explanation, threat-intelligence navigation, and hypothesis generation. That does not imply that probabilistic models should replace deterministic enforcement.

A useful division of labor is:

machines handle scale, retrieval, correlation, transformation, and repetitive variation;
deterministic policy enforces well-defined security invariants;
humans adjudicate ambiguity, exceptions, risk acceptance, and high-consequence response.

An LLM may help explain an unfamiliar PowerShell command. Application control should still decide whether the command is permitted. Security analysis can become probabilistic without making security-critical enforcement probabilistic by default.

Crisis authority must exist before the crisis

After stolen Berlin data were published, the Senate Chancellery announced a central steering unit under Berlin’s Chief Digital Officer to coordinate assessment and response across authorities.⁵⁸

Major incidents can simultaneously require technical containment, forensic preservation, credential revocation, data-impact assessment, legal analysis, regulatory notification, public communication, law-enforcement coordination, supplier escalation, and service-continuity decisions.

These responsibilities belong to different organizational units. Delay becomes likely when authority has to be negotiated during the incident. Institutions should predefine who can:

disconnect systems;
suspend identities;
revoke sessions;
invoke emergency procurement;
require supplier action;
authorize public communication;
accept temporary service degradation;
coordinate with external authorities.

Incident response is therefore not only a security-team runbook. It is an organizational decision system operating under uncertainty and time pressure.

Exercises should begin after the simulated click

Many security exercises stop at whether a user recognizes a lure. A stronger test assumes that the lure has already succeeded. For a TerminalFix-like scenario:

the employee has executed the command;
defenders must identify the endpoint and identity;
determine what executed and persisted;
reconstruct outbound communication;
determine reachable systems and accessed data;
revoke relevant authority;
isolate the endpoint;
preserve evidence;
coordinate organizational response.

A WeWorm-like exercise can start even later: a communication application on an executive’s phone has already been remotely compromised without deliberate interaction. That scenario tests mobile management, account isolation, identity boundaries, supplier escalation, patch distribution, alternate communications, and incident authority without allowing awareness training to dominate the exercise.

Resilience metrics should consequently include:

time from malicious execution to detection;
time from detection to isolation;
security zones reachable from the compromised context;
sensitive data accessible to the compromised identity;
reusable or privileged credentials exposed;
time required to revoke active sessions;
coverage of enforceable application-control policy;
proportion of critical outbound connectivity governed explicitly;
proportion of critical suppliers with defined vulnerability and incident-notification obligations.

These measures are imperfect, but they describe the institution rather than only its employees.

Compliance should be a floor, not the threat model

NIS2 is useful because it combines technical, operational, organizational, human, supply-chain, incident-management, and continuity measures.⁵⁹ ENISA’s implementation guidance likewise treats cybersecurity as interacting requirements rather than a single technical control.⁶⁰

Compliance evidence, however, is not identical to security evidence. An organization can have an incident-response policy while lacking rapid session revocation:

It can run annual phishing training while allowing arbitrary code execution on every endpoint.
It can maintain supplier questionnaires without enforceable vulnerability obligations.
It can claim segmentation while ordinary endpoints retain broad reachability.
It can mandate MFA while compromised authenticated sessions preserve excessive authority.

The operational test should therefore be:

does the control interrupt a plausible attack path?
can that interruption be demonstrated?
can the organization detect when the control fails?

That is the difference between proving that a control exists and proving that it changes attacker leverage.

Conclusion: assume the persuasion will eventually work

The Berlin incident is easy to narrate as a story about an employee who followed malicious instructions. Such an interpretation produces an identifiable failure and an intuitive remedy: teach employees not to do it again.

It is also incomplete. The reported TerminalFix mechanism matters because the attacker did not need to defeat every technical boundary directly. A deceptive interface could recruit legitimate human authority to cross an execution boundary. Microsoft’s independent TerminalFix research shows how an initial act of execution can develop into DLL sideloading, persistence, reconnaissance, remote command execution, and network tunnelling.⁶¹ The public evidence does not establish that Microsoft’s complete observed chain was the complete Berlin chain, but the architectural lesson does not depend on conflating those records.

A human-mediated initial compromise is the beginning of the explanation, not its end. What follows depends on the authority inherited by the compromised context: which code can execute, which credentials are exposed, which systems are reachable, which data can be read, which outbound connections are permitted, which behaviors are observable, and how quickly defenders can contain progression.

WeWorm makes the same point from the opposite direction. According to Calif, vulnerable WeChat processing could be reached through an incoming call without deliberate victim interaction, while successful compromise could initiate attacks against additional trusted contacts.⁶² ⁶³

One path exploits human interpretation. The other exploits software implementation. Both eventually confront the same security invariant:

a single crossed boundary should not confer enough authority to determine the fate of the institution.

Generative AI makes that invariant more important because it changes how often attackers can test boundaries. The phishing evidence reviewed here does not show that language models make deception irresistible. It shows that parts of personalized campaign production can be automated at quality levels that, in at least one human-subject experiment, matched manually prepared expert messages.⁶⁴

The WeWorm disclosure does not show that general-purpose models can autonomously weaponize arbitrary vulnerabilities. It shows one self-reported case in which skilled researchers used AI assistance during unusually rapid vulnerability and exploit development.⁶⁵

The defensible common inference is economic: when machine assistance lowers the cost of some attacker tasks, the same human expertise can support more targets, more hypotheses, more variants, or faster iteration. Prevention therefore remains necessary, but perfection becomes less plausible.

Employees should learn that websites should not normally require unexplained terminal commands. Phishing-resistant authentication should replace replayable authentication where feasible. Mail, browser, endpoint, network, and identity systems should continue trying to prevent initial compromise.

Yet the strategic model should assume that some attacks cross the first boundary anyway. A successful exploit need not imply a successful breach. A workstation can be compromised without yielding broad internal access. An account can be compromised without exposing an entire archive. Malicious code can run without establishing persistent command-and-control. An endpoint can become hostile without every internal service trusting its network location. A serious vulnerability can exist without remaining exploitable for long if mitigation is rapid.

These are not exceptions to security architecture. They are its purpose.

%%{init: {"theme": "neo", "look": "handDrawn", "layout": "elk"}}%%
flowchart TD
    A[Persuasive<br/>social engineering] --> E[Initial trust context<br/>compromised]
    B[Zero-click vulnerable<br/>processing] --> E
    C[Stolen or abused<br/>identity] --> E
    D[Vulnerable external<br/>service] --> E

    E --> F[Execution +<br/>privilege boundary]
    F --> G[Identity +<br/>authorization boundary]
    G --> H[Network +<br/>service boundary]
    H --> I[Data-access<br/>boundary]
    I --> J[Outbound +<br/>exfiltration boundary]

    K[Behavioral detection<br/>and observability] -. observes .-> F
    K -. observes .-> G
    K -. observes .-> H
    K -. observes .-> I
    K -. observes .-> J

    L[Prepared containment<br/>and session revocation] -. interrupts .-> F
    L -. interrupts .-> G
    L -. interrupts .-> H
    L -. interrupts .-> I
    L -. interrupts .-> J

    J --> M{Independent boundaries<br/>remain effective?}
    M -->|Yes| N[Contained incident<br/>+ recovery]
    M -->|No| O[Expanded compromise]
    O --> P[Data loss, disruption,<br/>extortion or propagation]

Figure 6: A resilient security architecture assumes that different initial-access mechanisms can succeed and places independent boundaries between initial compromise and unacceptable institutional consequences.

Figure 6 is intentionally agnostic about which initial-access technique wins. Threat intelligence remains indispensable because knowing about TerminalFix, WeWorm, exploited vulnerabilities, or active infrastructure improves prevention and prioritization; resilience supplies something different, because it remains useful when the attack was not predicted in time.

This changes institutional accountability as well. If employees are treated as the primary security boundary, incidents can always be explained retrospectively as someone choosing incorrectly. Yet employees do not normally control application policy, segmentation, identity architecture, telemetry, data entitlement, supplier obligations, or emergency authority.

Management, architecture teams, technology owners, procurement functions, security organizations, and suppliers shape those conditions. The more useful executive question is therefore not merely:

How many employees failed the phishing simulation?

It is:

What can an attacker do after one of them fails?

That question reaches execution policy, identity, network architecture, data governance, observability, incident response, supplier management, and business continuity simultaneously.

The strategic unit of defense is consequently the attack path. TerminalFix begins with persuasion. WeWorm begins with vulnerable automatic processing. Another attack may begin with a purchased credential, a compromised supplier, a vulnerable Internet-facing service, or a malicious insider.

Threat labels change; the path from initial opportunity to unacceptable consequence remains the durable object of defensive engineering:

Assume that an employee will eventually believe a professionally constructed deception.
Assume that a legitimate-looking interface will sometimes be trusted.
Assume that stronger authentication will redirect some attackers toward other forms of authorization abuse.
Assume that widely deployed software will occasionally contain remotely exploitable defects.
Assume that a trusted identity, endpoint, application, or supplier will eventually become hostile.
Assume that generative AI will make at least some forms of adversarial experimentation cheaper.

Then design from there. Awareness remains, but it is no longer the fuse protecting the organization. Authentication becomes stronger, but authenticated sessions do not receive unlimited trust. Endpoints are hardened, but compromise is anticipated. Networks are segmented because internal location does not prove benign intent. Data access is constrained because legitimate authorization becomes attacker authorization after account compromise. Telemetry follows causal attack sequences. Incident authority exists before the emergency. Suppliers are evaluated partly by how quickly vulnerabilities can be mitigated. Exercises begin not only before the click, but after it.

The objective is not an organization in which nobody can ever be deceived and no software can ever be exploited. That organization does not exist. The defensible objective is an institution in which deception, exploitation, and compromise can occur without automatically becoming catastrophe. Against adversaries whose capacity for persuasion, variation, reconnaissance, and experimentation can increasingly be amplified by machines, cybersecurity maturity begins with a difficult assumption:

eventually, the persuasion will work—or the exploit will not need persuasion at all.

The decisive question is what the organization has engineered to happen next.

Appendix: updates after the 9 September 2026 initial publication

Berlin: the public incident record has become more specific

Berlin’s central incident portal, updated after the original publication date, now states that the major part of the data exfiltration occurred between 7 and 12 August 2026, that stolen data were published on 4 September, and that the affected environments included the Senate Department for Mobility, Transport, Climate Protection and the Environment and the Senate Department for Urban Development, Building and Housing. The city says the exfiltrated material consisted primarily of unstructured data from shared and personal directories rather than data from specific specialist applications.⁶⁶

A separate affected-person notice from the mobility and environment administration, updated on 15 September, identifies applicants and former employees among the affected groups. The potentially exposed material includes application files and CV information and, for some records, sensitive personal information such as health or disability data; the former-employee notice also lists personnel records, personal-drive content, email, and religious-affiliation information among possible categories.⁶⁷ The administration explicitly warns that biographical and professional details from the leak could be used to make impersonation and profile-specific social engineering more credible. That warning is a risk assessment, not evidence that such secondary attacks have already occurred.

These updates refine the timeline and data scope and add a concrete example of how breached contextual data can improve later social-engineering pretexts. They do not change the evidentiary distinction used throughout this article: Berlin-specific reporting about TerminalFix should remain separate from Microsoft’s independent reconstruction of a TerminalFix campaign.

Cyber Resilience Act reporting obligations are now operational

A regulatory statement that was prospective on the article’s original publication date has since become current. From 11 September 2026, Article 14 reporting obligations under the EU Cyber Resilience Act apply to manufacturers of products with digital elements for actively exploited vulnerabilities and severe security incidents. The EU Single Reporting Platform is now operational; the reporting process includes an early warning within 24 hours and a fuller notification within 72 hours, followed by the applicable final report.⁶⁸

This does not change the article’s lifecycle-security argument, but it makes one part of that argument operational rather than future-facing: vulnerability handling now includes a live EU reporting obligation even though the CRA’s broader product requirements generally apply from 11 December 2027.

NIST has finalized additional guidance on post-authentication token risk

On 15 September 2026, NIST finalized IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. The guidance addresses the lifecycle of tokens and authentication assertions, including protection, verification, monitoring, revocation, and coordination of risk signals.⁶⁹

This is directly relevant to the article’s distinction between successful authentication and continuing trust. Resetting a password, isolating an endpoint, or proving who originally authenticated does not necessarily eliminate already issued authorization material. Post-compromise resilience therefore requires visibility into sessions and tokens and the ability to revoke them at useful granularity.

WeWorm: the core technical evidentiary boundary remains unchanged

Calif’s public disclosure has since been updated to note additional press coverage, but as of 17 September it still withholds the low-level details of the WeChat VoIP memory-corruption vulnerability pending a later technical presentation.⁷⁰ The article’s distinction therefore remains appropriate: the public evidence supports the demonstrated zero-click behavior, WeChat-level RCE and propagation mechanism, but not an independent reconstruction of the corruption primitive or complete platform-specific exploit chains.

Footnotes

Press and Information Office of the State of Berlin. (2026). IKT-Vorfall im Landesnetz Berlin. State of Berlin. Official release ↩︎
Press and Information Office of the State of Berlin. (2026). Mehr Daten beim IKT-Vorfall abgeflossen. State of Berlin. Official release ↩︎
Press and Information Office of the State of Berlin. (2026). Aktuelle Lage nach dem IKT-Vorfall im Landesnetz Berlin. State of Berlin. Official release ↩︎
Press and Information Office of the State of Berlin. (2026). Aktuelle Lage nach dem IKT-Vorfall – Zentrale Steuerungseinheit in der Senatskanzlei eingerichtet. State of Berlin. Official release ↩︎
Röhricht, S. (2026). Behörde veröffentlicht neue Details zum Angriff: Mit dieser Methode drangen die Hacker offenbar in Berlins IT-Netz ein. Der Tagesspiegel. Article ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Tencent Security Response Center. (2026). 仲夏有约｜加测！百万奖池+4倍积分持续燃夏. Tencent Security Response Center. Official announcement ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
National Institute of Standards and Technology. (2026). Human-Centered Cybersecurity: Phishing. NIST Computer Security Resource Center. Official research page ↩︎
Dawkins, S., & Jacobs, J. (2023). NIST Phish Scale User Guide. NIST Technical Note 2276. DOI ↩︎
Haney, J. (2023). Users Are Not Stupid: Six Cyber Security Pitfalls Overturned. National Institute of Standards and Technology. Official publication ↩︎
Cybersecurity and Infrastructure Security Agency & National Security Agency. (2023). NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. CISA Cybersecurity Advisory AA23-278A. Official advisory ↩︎
Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware Guide. CISA. Official guide ↩︎
Cybersecurity and Infrastructure Security Agency. (2022, October 31). Implementing Phishing-Resistant MFA. CISA. Official fact sheet ↩︎
Heiding, F., Lermen, S., Kao, A., Schneier, B., & Vishwanath, A. (2024). Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects. arXiv. DOI ↩︎
Heiding, F., Lermen, S., Kao, A., Schneier, B., & Vishwanath, A. (2024). Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects. arXiv. DOI ↩︎
Microsoft. (2025). Microsoft Digital Defense Report 2025: Lighting the path to a secure future. Microsoft. Official report ↩︎
European Union Agency for Cybersecurity. (2025). ENISA Threat Landscape 2025. ENISA. Official report ↩︎
European Union Agency for Cybersecurity. (2025). ENISA Threat Landscape 2025. ENISA. Official report ↩︎
Microsoft. (2025). Microsoft Digital Defense Report 2025: Lighting the path to a secure future. Microsoft. Official report ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Microsoft. (2025). Microsoft Digital Defense Report 2025: Lighting the path to a secure future. Microsoft. Official report ↩︎
European Union Agency for Cybersecurity. (2025). ENISA Threat Landscape 2025. ENISA. Official report ↩︎
European Union Agency for Cybersecurity. (2025). ENISA Threat Landscape 2025. ENISA. Official report ↩︎
Microsoft. (2025). Microsoft Digital Defense Report 2025: Lighting the path to a secure future. Microsoft. Official report ↩︎
Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware Guide. CISA. Official guide ↩︎
Microsoft. (2026). Application Control for Windows. Microsoft Learn. Official documentation ↩︎
Microsoft. (2026). Use App Control to secure PowerShell. Microsoft Learn. Official documentation ↩︎
Microsoft. (2026). How to use App Control to secure PowerShell. Microsoft Learn. Official documentation ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207. DOI ↩︎
Cybersecurity and Infrastructure Security Agency. (2022, October 31). Implementing Phishing-Resistant MFA. CISA. Official fact sheet ↩︎
Press and Information Office of the State of Berlin. (2026). IKT-Vorfall im Landesnetz Berlin. State of Berlin. Official release ↩︎
European Parliament & Council of the European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Official Journal of the European Union, L 333. Official text ↩︎
European Union Agency for Cybersecurity. (2025). Technical implementation guidance on cybersecurity risk management measures, version 1.0. ENISA. Official publication ↩︎
European Commission. (2026). Cyber Resilience Act — Manufacturers. Shaping Europe’s Digital Future. Official guidance ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Press and Information Office of the State of Berlin. (2026). Aktuelle Lage nach dem IKT-Vorfall – Zentrale Steuerungseinheit in der Senatskanzlei eingerichtet. State of Berlin. Official release ↩︎
European Parliament & Council of the European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Official Journal of the European Union, L 333. Official text ↩︎
European Union Agency for Cybersecurity. (2025). Technical implementation guidance on cybersecurity risk management measures, version 1.0. ENISA. Official publication ↩︎
Microsoft Security Research, Patil, S., Natarajan, S., & Raghavan, P. (2026). TerminalFix campaign deploys a reverse tunnel through multistage intrusion. Microsoft Security Blog. Technical analysis ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Heiding, F., Lermen, S., Kao, A., Schneier, B., & Vishwanath, A. (2024). Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects. arXiv. DOI ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎
Press and Information Office of the State of Berlin. (2026, September 14). Cyberangriff: Informationen für Bürgerinnen und Bürger. State of Berlin. Official incident portal ↩︎
Senate Department for Mobility, Transport, Climate Protection and the Environment. (2026, September 15). Datenschutzvorfall. State of Berlin. Official affected-person information ↩︎
European Commission. (2026). Cyber Resilience Act — Reporting obligations. Shaping Europe’s Digital Future. Official guidance ↩︎
National Institute of Standards and Technology. (2026, September 15). NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse — Implementation Recommendations. NIST. Official publication ↩︎
Calif Research. (2026). WeWorm. Calif Research. Technical disclosure ↩︎