Loading story…
Microsoft has added new Windows protections to blunt phishing attacks that use malicious Remote Desktop connection (.rdp) files to connect victims to attacker-controlled systems and expose local resources. The changes, delivered through recent cumulative updates for Windows 10 and Windows 11, introduce clearer security warnings, display publisher and remote system details, and alert users when RDP files are unsigned before a connection is established.
The updated behavior also disables risky redirected local resource options by default when users open .rdp files directly, limiting abuse of shared drives, clipboard access, and other redirections that can be used to steal files, credentials, or authentication data. Microsoft said the protections target a technique long used in phishing campaigns, including by APT29, though they do not apply when connections are launched from the Windows Remote Desktop client itself; administrators can temporarily turn the safeguards off through a Registry policy setting, but Microsoft recommends keeping them enabled.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
After shipping the April 14 Windows protections for malicious .rdp files, Microsoft disclosed a Known Issue causing the new warning dialog to render incorrectly, with overlapping text or partially hidden buttons, especially on multi-monitor systems with mixed display scaling. Microsoft said the issue is largely cosmetic and will be fixed in a future Windows update.
Microsoft released new Windows 10 and Windows 11 protections in the April 2026 cumulative updates to reduce phishing attacks that abuse Remote Desktop connection (.rdp) files. The changes add user warnings, show publisher and remote connection details, and disable redirected local resources by default before a connection is established.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcelearn.microsoft.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon and Microsoft disclosed a large spear-phishing campaign by **APT29**/**Midnight Blizzard**, the Russian state-linked espionage group tied to the **SVR**, that used signed malicious **`.rdp`** files to trick targets into launching outbound Remote Desktop connections to attacker-controlled servers. The operation, tracked by CERT-UA as **`UAC-0215`**, relied on emails sent from previously compromised legitimate accounts and lures themed around **Amazon Web Services**, **Microsoft**, and **Zero Trust** integration issues. Amazon said the attackers used lookalike AWS-related domains, which it moved to seize, but the campaign was aimed at stealing victims' **Windows credentials** and collecting data rather than compromising Amazon or AWS customer accounts directly. Microsoft said the campaign targeted **thousands of recipients across dozens of countries**, including Ukraine, the UK, Europe, Australia, and Japan, with victims spanning government, academia, defense, and NGOs. CERT-UA warned that opening the rogue RDP attachments could expose local disks, network shares, printers, COM ports, audio devices, clipboard contents, and credentials to the attackers, while also enabling unauthorized program or script execution for follow-on activity. Defenders were urged to block **`.rdp`** files at email gateways, monitor and restrict outbound RDP connections from **`mstsc.exe`**, and apply the indicators and mitigations published by Microsoft and CERT-UA.
Jun 29, 2026
Microsoft released fixes for two **Windows Remote Desktop Protocol (RDP)** information disclosure vulnerabilities, `CVE-2026-42908` and `CVE-2026-45639`, that allow a remote, unauthenticated attacker to trigger out-of-bounds reads and expose sensitive memory without user interaction. According to reporting on the June 9, 2026 security updates, `CVE-2026-42908` can disclose local memory addresses and weaken **ASLR**, while `CVE-2026-45639` can reveal process memory including credentials, session tokens, and protocol state data. Microsoft rated both flaws **Important** with **CVSS 7.5** and said exploitation was considered less likely at release, with no public exploits reported. The vulnerabilities affect a broad set of Windows platforms, including **Windows 10**, **Windows 11**, **Windows Server 2012 through 2025**, and Microsoft’s Remote Desktop client offerings for Windows desktop. The disclosures arrive amid continued scrutiny of the RDP ecosystem after earlier reports of severe Remote Desktop weaknesses, including `CVE-2025-29967` in **RD Gateway** and `CVE-2025-29966` and `CVE-2025-48817` in the **Windows Remote Desktop Client**, which were described as enabling remote code execution through heap overflow or path traversal conditions. Organizations were urged to prioritize patching internet-exposed RDP systems and strengthen access controls with VPNs, bastion hosts, strong authentication, and monitoring.
Jun 29, 2026
Microsoft published security advisories for multiple remote code execution vulnerabilities affecting **Remote Desktop Client**, **Remote Desktop Protocol**, and the **Remote Procedure Call (RPC) Runtime**. The referenced issues include `CVE-2025-58718` in the Remote Desktop Client, alongside earlier Microsoft advisories for `CVE-2022-21851` in the Remote Desktop Client, `CVE-2022-21893` in Remote Desktop Protocol, and `CVE-2022-21922` in the RPC Runtime. The advisories indicate continued security risk around core Windows remote access and interprocess communication components that are widely used in enterprise environments. For defenders, the common thread is exposure to **remote code execution** in services and clients tied to remote connectivity, making Microsoft’s security updates for these CVEs a priority for systems that rely on RDP and RPC functionality.
Jul 12, 2026