Loading story…
Microsoft disclosed CVE-2024-38200, a vulnerability in Microsoft Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps that can let a remote, unauthenticated attacker exfiltrate NTLM hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a CVSS 7.5 severity score. Researchers from PrivSec Consulting identified the flaw and planned to present additional details at DEF CON.
Microsoft said mitigations were rolled out through Feature Flighting for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the Protected Users security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound TCP 445/SMB traffic to prevent credential leakage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The PrivSec Consulting researchers planned to disclose more technical details about CVE-2024-38200 at DEF CON. No specific conference date is given in the provided content.
Microsoft advised customers to install the final security updates released in the August Patch Tuesday cycle to address CVE-2024-38200. The source also notes additional recommended mitigations such as blocking outbound NTLM communication and SMB traffic and using the Protected Users Security Group.
Microsoft disclosed CVE-2024-38200, describing it as a flaw in Microsoft Office and Microsoft 365 Apps that could let a remote unauthenticated attacker exfiltrate NTLM hashes after user interaction. The company also deployed mitigations through Feature Flighting to supported Office and Microsoft 365 versions.
Researchers from PrivSec Consulting discovered CVE-2024-38200, a Microsoft Office and Microsoft 365 Apps vulnerability that can enable NTLM hash exfiltration. The reference does not provide a specific discovery date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched three Windows spoofing vulnerabilities affecting the **Windows Security App**, **Windows Storage**, and **NTLM** authentication components. The issues were tracked as `CVE-2025-47956`, `CVE-2025-49760`, and `CVE-2025-24054`, with the last specifically described as an **NTLM Hash Disclosure Spoofing Vulnerability**, raising the risk of credential exposure through spoofing-related attack paths. The advisories were published through Microsoft's Security Update Guide and indicate that multiple core Windows components required security fixes for spoofing weaknesses. For defenders, the disclosures highlight the need to prioritize Microsoft security updates, review systems that rely on NTLM authentication, and assess whether exposed Windows endpoints or storage-related workflows could be abused for impersonation, misleading trust signals, or credential theft.
Jul 12, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026
Microsoft has patched **CVE-2026-33829**, a spoofing vulnerability in the Windows Snipping Tool that can trigger an authenticated SMB connection to an attacker-controlled server and expose a victim’s **NTLMv2 password hash**. The flaw stems from improper validation of deep links using the `ms-screensketch` URI scheme, allowing attackers to coerce the application into initiating network authentication and leaking credentials over the network. Researchers at **Blackarrow (Tarlogic)** reported the issue, which Microsoft rated **moderate severity** with a **CVSS 3.1 score of 4.3** and said was **not known to be exploited in the wild**. Exploitation requires user interaction, such as clicking a malicious link in a phishing email or on a compromised website, but the attack complexity is considered low. Affected systems include multiple **Windows 10, Windows 11, and Windows Server** releases, and recommended defenses include applying Microsoft’s update, blocking outbound SMB traffic on port `445`, and warning users against suspicious links and application launch prompts.
Jun 29, 2026