CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Microsoft Disables File Explorer Preview for Downloaded Files to Mitigate NTLM Theft Attacks

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Microsoft has disabled the File Explorer preview feature for files downloaded from the Internet. This change aims to block credential theft attacks that exploit vulnerabilities in the preview functionality. The update is live for Windows 11 and Windows Server systems that have installed the October 2025 Patch Tuesday updates. The new security measure prevents attackers from obtaining NTLM hashes when users preview files containing malicious HTML tags. This attack vector does not require user interaction beyond selecting a file to preview, making it a significant security risk. Users can manually remove the Internet security block for trusted files or configure specific file shares to bypass the preview restriction.

Timeline

  1. 23.10.2025 18:57 1 articles · 23h ago

    Microsoft Disables File Explorer Preview for Downloaded Files

    Starting with the October 2025 Patch Tuesday updates, Microsoft has disabled the File Explorer preview feature for files downloaded from the Internet. This change aims to block credential theft attacks that exploit vulnerabilities in the preview functionality. The update is live for Windows 11 and Windows Server systems and affects files marked with the Mark of the Web (MotW) and those viewed on an Internet Zone file share.

    Show sources
    Open in new tab

Information Snippets