Loading story…
Microsoft has patched CVE-2026-33829, a spoofing vulnerability in the Windows Snipping Tool that can trigger an authenticated SMB connection to an attacker-controlled server and expose a victim’s NTLMv2 password hash. The flaw stems from improper validation of deep links using the ms-screensketch URI scheme, allowing attackers to coerce the application into initiating network authentication and leaking credentials over the network.
Researchers at Blackarrow (Tarlogic) reported the issue, which Microsoft rated moderate severity with a CVSS 3.1 score of 4.3 and said was not known to be exploited in the wild. Exploitation requires user interaction, such as clicking a malicious link in a phishing email or on a compromised website, but the attack complexity is considered low. Affected systems include multiple Windows 10, Windows 11, and Windows Server releases, and recommended defenses include applying Microsoft’s update, blocking outbound SMB traffic on port 445, and warning users against suspicious links and application launch prompts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After Microsoft issued its April 14, 2026 patch, Black Arrow researchers published a coordinated advisory and proof-of-concept exploit for the Snipping Tool NTLM hash leak vulnerability. The PoC demonstrated abuse of the ms-screensketch deep link with a UNC path to trigger outbound SMB authentication and expose a victim's Net-NTLM hash.
Public coverage described how the flaw abuses the ms-screensketch deep-link handler to coerce outbound SMB authentication and leak NTLMv2 hashes. Reports also identified affected Windows 10, Windows 11, and Windows Server versions and highlighted mitigations such as patching and blocking outbound SMB on port 445.
Microsoft published CVE-2026-33829 in its Security Update Guide as part of the April 14, 2026 security updates. The company rated the Windows Snipping Tool spoofing flaw as moderate severity, said exploitation was less likely, and noted no known in-the-wild exploitation.
Blackarrow researchers at Tarlogic discovered a spoofing vulnerability in the Windows Snipping Tool involving improper validation of the ms-screensketch URI scheme and reported it to Microsoft. The issue could trigger an authenticated SMB connection to an attacker-controlled server and expose the victim's NTLMv2 hash.
BlackarrowSec researchers reported the Snipping Tool NTLM hash disclosure vulnerability to Microsoft through responsible disclosure. The disclosure occurred ahead of Microsoft's April 2026 security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026
Microsoft disclosed and patched three Windows spoofing vulnerabilities affecting the **Windows Security App**, **Windows Storage**, and **NTLM** authentication components. The issues were tracked as `CVE-2025-47956`, `CVE-2025-49760`, and `CVE-2025-24054`, with the last specifically described as an **NTLM Hash Disclosure Spoofing Vulnerability**, raising the risk of credential exposure through spoofing-related attack paths. The advisories were published through Microsoft's Security Update Guide and indicate that multiple core Windows components required security fixes for spoofing weaknesses. For defenders, the disclosures highlight the need to prioritize Microsoft security updates, review systems that rely on NTLM authentication, and assess whether exposed Windows endpoints or storage-related workflows could be abused for impersonation, misleading trust signals, or credential theft.
Jul 12, 2026