Microsoft Boosts Windows Security by Disabling File Previews for Downloads
Microsoft has introduced a security enhancement to Windows File Explorer, effective from Tue, Oct 14, 2025. This update automatically disables the preview pane for files downloaded from the internet, addressing a vulnerability that has been exploited to…
Microsoft has introduced a security enhancement to Windows File Explorer, effective from Tue, Oct 14, 2025. This update automatically disables the preview pane for files downloaded from the internet, addressing a vulnerability that has been exploited to harvest NTLM hashes and sensitive credentials used for network authentication.
The vulnerability arises from Windows's handling of file previews containing HTML elements, such as <link> or <src> tags, which point to external resources. When users preview these malicious files in File Explorer, unauthorized network requests can be triggered, exposing NTLM hashes to attackers.
This method has been commonly used in phishing and malware campaigns targeting Windows environments, particularly where NTLMv2 weaknesses persist. The update leverages the "Mark of the Web" (MotW) attribute, automatically applied to files from untrusted sources like the internet, preventing their previews in File Explorer.
Upon accessing such files, users receive a warning: "The file you are attempting to preview could harm your computer. If you trust the file and the source from which you received it, you may open it to view its contents."
Microsoft has introduced a security enhancement to Windows File Explorer, effective from Tue, Oct 14, 2025.
For users, this results in a minor workflow change, with previews disabled only for potentially risky files. Local documents and trusted shares remain unaffected. The protection activates automatically post-update, reducing the attack surface without requiring additional configuration.
To preview a trusted download, users can right-click the file in File Explorer, select Properties, and check the "Unblock" box. For entire file shares, users can add the address to the Local Intranet or Trusted Sites zone via Internet Options in Control Panel. However, this approach should be used cautiously as it reduces defenses for all files from that source.
Microsoft advises trusting files only from known origins, positioning this update as a mitigation strategy. As cyber threats continue to evolve, such incremental security refinements help maintain Windows resilience while balancing security with user experience.
Based on reporting by GBHackers.