Loading story…
Microsoft is rolling out a Windows 11 change that restores limited access to File Explorer's Preview pane for files marked with Mark of the Web after previously disabling previews by default to mitigate NTLM hash leakage risks. The original restriction, introduced in late 2025, affected files downloaded from the internet, email attachments, and some cloud-synced content, requiring users to manually unblock trusted files before previewing them.
The updated behavior adds a "Preview anyway" button in File Explorer, letting users override the warning for trusted files while keeping the safer default in place. The feature appeared earlier in Windows Insider Release Preview builds 26100.8313 and 26200.8313, and broader availability is expected as Microsoft balances usability complaints with protections against unsafe file previews.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft documented in Windows Insider release notes that File Explorer would add a "Preview anyway" button for files downloaded from the internet after showing a warning. The feature was presented as a way to let users override the warning for trusted files while keeping the protection enabled by default.
Microsoft disabled File Explorer Preview pane previews by default for files carrying Mark of the Web after identifying a risk that previewing unsafe files could leak NTLM hashes. The change affected downloaded PDFs, documents, images, email attachments, cloud-storage files, and other internet-sourced files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
windowslatest.com
Open sourceblogs.windows.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has implemented a security update in Windows 11 and Windows Server that disables the File Explorer preview pane for files downloaded from the internet. This change is designed to prevent credential theft attacks that exploit the preview feature, specifically targeting files marked with the Mark of the Web (MotW) or those accessed from Internet Zone file shares. When users attempt to preview such files, they are now shown a warning message instead of a file preview, reducing the risk of inadvertently leaking sensitive information. The update, which is included in the October 2025 Patch Tuesday release, addresses a vulnerability where threat actors could obtain NTLM hashes by embedding malicious HTML tags in files. This attack vector required minimal user interaction, as simply selecting a file to preview could trigger the exploit. By disabling previews for potentially unsafe files, Microsoft aims to enhance user security and mitigate the risk of credential theft through this method.
Jun 29, 2026
Microsoft’s latest Windows 11 preview releases for Insiders and optional updaters introduce **native Sysmon** and ship fixes for disruptive **Windows Explorer/taskbar** regressions. Windows 11 Insider Dev Channel Build `26300.7733` (KB5074178) adds Sysmon as a built-in *Optional Feature*, bringing deeper endpoint telemetry (e.g., process creation with command lines, network connections, driver loads, and file timestamp manipulation) intended to improve forensic visibility and incident investigation; Microsoft notes the integrated Sysmon conflicts with legacy standalone Sysmon installs, requiring removal of the older version before enabling the new feature. Separately, the optional preview update **KB5074105** for Windows 11 `24H2`/`25H2` addresses a January cumulative-update regression where `Explorer.exe` could hang at startup—causing the taskbar to intermittently disappear and forcing users to restart Explorer via Task Manager—and also fixes reports of desktop icons being rearranged unexpectedly. ZDNET characterizes the upcoming February Windows 11 patch as feature-heavy and indicates KB5074105 is an early look at what will roll into the broader monthly release, while other referenced ZDNET pieces are general OS commentary/comparisons and not tied to the Sysmon integration or the KB5074105 Explorer fix; an Android 17 feature roundup is unrelated.
Jun 29, 2026
Microsoft released the Windows 11 optional preview cumulative update **KB5074105** (for **Windows 11 24H2 and 25H2**) with multiple fixes and changes, including resolving a known issue where the **password sign-in option/icon could disappear** from lock screen sign-in options after installing updates dating back to the August 2025 preview update line. Affected users could still authenticate by hovering over the blank area where the password option should appear to reveal the hidden button; Microsoft reports the issue is addressed in KB5074105. The same KB5074105 preview update also introduces a local hardening change to reduce unauthorized interaction with sensitive system information by adding a **mandatory User Account Control (UAC) prompt** when accessing **Settings > System > Storage**. This change is intended to prevent non-admin users (or threat actors with local/remote access to a non-admin session) from viewing or manipulating detailed storage and temporary-file/system-file information without administrative approval, and is being rolled out as an optional “C-release” preview ahead of broader deployment.
Jun 29, 2026