Microsoft Disables File Explorer Preview for Downloads to Block Credential Theft Attacks
In a decisive move to bolster Windows security, Microsoft has announced a significant change to File Explorer: the preview pane will now be disabled by default for files downloaded from the internet.
This update, rolled out as part of the October 2025 Patch Tuesday, aims to prevent a stealthy vulnerability that could expose users’ NTLM hashes—sensitive credentials used for network authentication.
Why the Change?
The root of the issue lies in how File Explorer handles previews. When a user selects a file, the preview pane may attempt to load embedded content such as images or links. If these references point to external paths—especially those controlled by attackers—Windows may inadvertently initiate an authentication request, leaking NTLM credentials in the process.
This vulnerability is particularly dangerous because it requires no user interaction beyond simply selecting the file. Attackers can exploit this to harvest credentials without needing the user to open or execute the file.
What Files Are Affected?
The change applies to files tagged with the Mark of the Web (MotW)—a metadata flag added to files downloaded via browsers, email attachments, or other internet sources. It also affects files accessed from Internet Zone file shares.
When attempting to preview such files, users will now see a warning message:
“The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.”
How to Unblock Trusted Files
For users who need to preview a file from a trusted source, Microsoft provides a manual override:
- Right-click the file in File Explorer.
- Select Properties.
- Click the Unblock button at the bottom of the General tab.
- Apply and OK.
Note: The change may not take effect immediately and could require signing out and back in.
Final Thoughts
Microsoft’s decision to disable File Explorer previews for downloaded files is a proactive step toward securing Windows systems against increasingly sophisticated credential theft attacks. While it may slightly alter user experience, the trade-off for enhanced security is well worth it—especially in an era where phishing and malware campaigns are on the rise.
For most users, no action is required. The protection is enabled automatically with the October 2025 update. But for those who frequently preview downloaded files, understanding how to safely unblock trusted content is key.
