Loading story…
Microsoft has implemented a security update in Windows 11 and Windows Server that disables the File Explorer preview pane for files downloaded from the internet. This change is designed to prevent credential theft attacks that exploit the preview feature, specifically targeting files marked with the Mark of the Web (MotW) or those accessed from Internet Zone file shares. When users attempt to preview such files, they are now shown a warning message instead of a file preview, reducing the risk of inadvertently leaking sensitive information.
The update, which is included in the October 2025 Patch Tuesday release, addresses a vulnerability where threat actors could obtain NTLM hashes by embedding malicious HTML tags in files. This attack vector required minimal user interaction, as simply selecting a file to preview could trigger the exploit. By disabling previews for potentially unsafe files, Microsoft aims to enhance user security and mitigate the risk of credential theft through this method.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft changed Windows 11 File Explorer to block preview pane rendering for files downloaded from the web, a mitigation intended to reduce NTLM credential theft and similar attack paths. Multiple reports on October 23-24, 2025 describe the same product security hardening change.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is rolling out a Windows 11 change that restores limited access to File Explorer's Preview pane for files marked with **Mark of the Web** after previously disabling previews by default to mitigate **NTLM hash leakage** risks. The original restriction, introduced in late 2025, affected files downloaded from the internet, email attachments, and some cloud-synced content, requiring users to manually unblock trusted files before previewing them. The updated behavior adds a **"Preview anyway"** button in File Explorer, letting users override the warning for trusted files while keeping the safer default in place. The feature appeared earlier in Windows Insider Release Preview builds `26100.8313` and `26200.8313`, and broader availability is expected as Microsoft balances usability complaints with protections against unsafe file previews.
Aug 24, 2026
Microsoft has added new Windows protections to blunt phishing attacks that use malicious Remote Desktop connection (`.rdp`) files to connect victims to attacker-controlled systems and expose local resources. The changes, delivered through recent cumulative updates for Windows 10 and Windows 11, introduce clearer security warnings, display publisher and remote system details, and alert users when RDP files are unsigned before a connection is established. The updated behavior also disables risky redirected local resource options by default when users open `.rdp` files directly, limiting abuse of shared drives, clipboard access, and other redirections that can be used to steal files, credentials, or authentication data. Microsoft said the protections target a technique long used in phishing campaigns, including by **APT29**, though they do not apply when connections are launched from the Windows Remote Desktop client itself; administrators can temporarily turn the safeguards off through a Registry policy setting, but Microsoft recommends keeping them enabled.
Jun 29, 2026
Microsoft disclosed **CVE-2024-38200**, a vulnerability in **Microsoft Office 2016**, **Office 2019**, **Office LTSC 2021**, and **Microsoft 365 Apps** that can let a remote, unauthenticated attacker exfiltrate **NTLM** hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a **CVSS 7.5** severity score. Researchers from **PrivSec Consulting** identified the flaw and planned to present additional details at **DEF CON**. Microsoft said mitigations were rolled out through **Feature Flighting** for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the **Protected Users** security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound **TCP 445/SMB** traffic to prevent credential leakage.
Jul 24, 2026