Loading story…
Microsoft announced it will disable NTLM by default in future Windows releases, accelerating the retirement of the 30-year-old authentication protocol in favor of more secure, modern alternatives such as Kerberos and phishing-resistant, passwordless methods. NTLM remains widely used as a fallback when Kerberos is unavailable, but it relies on weak cryptography and is frequently abused for NTLM relay and pass-the-hash activity that can enable privilege escalation and domain compromise; the announcement highlights long-standing exploitation paths and coercion techniques associated with relay scenarios (e.g., PetitPotam, ShadowCoerce, DFSCoerce, RemotePotato0).
Separately, Microsoft is moving Exchange Online toward deprecating SMTP AUTH Basic Authentication for all tenants, citing persistent abuse of basic-auth SMTP for password spraying/brute force and subsequent account takeover used to send phishing and spam. The change targets legacy workflows (devices, scripts, and third-party tools) that keep basic auth enabled and often bypass modern controls like MFA and Conditional Access; the referenced timeline indicates SMTP AUTH Basic Authentication remains available until December 2026 to allow organizations to identify dependencies and migrate to stronger authentication methods.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the second phase of the NTLM transition is planned for the second half of 2026 and will focus on reducing fallback to NTLM, including Local KDC preview support and Windows component updates that prioritize Kerberos.
As Phase 1 of the NTLM transition, Microsoft made enhanced auditing available to help organizations identify where NTLM is still used and what triggers fallback to the protocol.
Microsoft said future major Windows releases will block network NTLM authentication by default as part of a phased transition toward Kerberos and a secure-by-default posture.
Microsoft said that after December 2026, SMTP AUTH Basic Authentication will be disabled by default for existing Exchange Online tenants, with temporary re-enablement available during migration. For new tenants created after that point, SMTP AUTH Basic Authentication will be unavailable by default and OAuth-based modern authentication will be the supported method.
Microsoft updated its Exchange Online timeline to keep SMTP AUTH Basic Authentication unchanged until December 2026, despite describing it as an outdated and frequently abused sign-in method.
Microsoft formally deprecated NTLM, reinforcing that the legacy protocol should be phased out because of its longstanding security weaknesses and abuse in enterprise attacks.
Microsoft previously signaled that NTLM would be retired, marking the start of its public move away from the legacy authentication protocol in favor of more secure alternatives.
In the final phase of the rollout, a future major Windows release will disable network NTLM authentication by default, while still allowing administrators to explicitly re-enable it through policy controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced a **three-phase roadmap** to reduce reliance on the legacy **NTLM** authentication protocol and ultimately **disable NTLM by default** in a future Windows release, pushing enterprises toward **Kerberos-based** authentication. The change is driven by NTLM’s long-documented weaknesses and exposure to common enterprise attack techniques including **NTLM relay**, **replay**, and **pass-the-hash**, which can enable unauthorized access to network resources when NTLM is used as a fallback. The plan starts with **Phase 1 (available now)** focused on *visibility and control* via enhanced **NTLM auditing** to identify where NTLM is still in use. **Phase 2 (targeted for the second half of 2026 / pre-release features)** aims to reduce NTLM usage by removing migration blockers and improving Kerberos behavior in scenarios that currently fall back to NTLM (including mechanisms such as **IAKerb** and a **local KDC**, and updates to Windows components to prioritize Kerberos). **Phase 3** will **turn NTLM off by default** while keeping it present in the OS for **backward compatibility**, allowing organizations to re-enable it via policy for legacy or NTLM-only dependencies during transition.
Jun 29, 2026
Security researchers have highlighted ongoing exploitation and new vulnerabilities in the NTLM authentication protocol, which remains widely used in enterprise environments despite its well-known weaknesses. Recent research details multiple attack vectors, including hash leakage, coercion-based attacks, credential forwarding, and man-in-the-middle (MitM) techniques, as well as the continued use of NTLM in modern operating systems and legacy applications. Notable campaigns in 2025 have leveraged vulnerabilities such as CVE-2024-43451, CVE-2025-24054, and CVE-2025-33073 to deliver malware and conduct targeted attacks, particularly in Russia and Uzbekistan. Proof-of-concept exploits for NTLM elevation of privilege vulnerabilities have been released, further increasing the risk to organizations that have not yet migrated away from NTLM or implemented robust mitigations. Security experts recommend disabling or limiting NTLM, enabling message signing, and monitoring authentication logs to reduce exposure. The persistence of NTLM in critical infrastructure underscores the urgent need for organizations to transition to more secure authentication protocols and to remain vigilant against evolving exploitation techniques targeting NTLM weaknesses.
Jun 29, 2026
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026