Microsoft Strengthens Windows Against RDP Phishing Attacks
Microsoft has rolled out critical security enhancements to combat a growing trend of phishing attacks that exploit Remote Desktop Connection (.rdp) files. By introducing new warnings and changing how local resources are shared, these updates aim to prevent threat actors from silently stealing sensitive data and credentials from unsuspecting users.
The Danger of Malicious RDP Files
Remote Desktop Protocol (RDP) files are widely used in corporate environments because they allow administrators to preconfigure connections, including the redirection of local resources to a remote host. However, this convenience has become a target for cybercriminals.
Threat actors, including the Russian state-sponsored hacking group APT29, have used rogue RDP files in phishing campaigns. When a victim opens a malicious file, their device can silently connect to an attacker-controlled server. Once connected, these files can be configured to:
- Redirect local drives to the remote device, allowing attackers to steal files and credentials stored on the disk.
- Capture clipboard data, including passwords or confidential text.
- Redirect authentication mechanisms, such as smart cards or Windows Hello, to impersonate the user.
New Safeguards and CVE-2026-26151
To address these risks, Microsoft has introduced safeguards to counter a remote desktop spoofing vulnerability identified as CVE-2026-26151. These protections are delivered through the April 2026 cumulative updates.
What’s Changing for Users?
The updates change the experience of opening an RDP file to ensure users are fully aware of the connection’s risks:
- Educational Prompt: The first time a user opens an RDP file after the update, a one-time educational prompt appears. This alert explains what RDP files are and warns about the associated phishing risks.
- Security Dialog: Before any connection is established, a new security dialog displays the remote computer’s address, publisher information (where available), and any requested access to local resources.
- Disabled by Default: In a significant shift, all requested resource settings are now disabled by default. Users must explicitly enable them before they can connect.
these changes only trigger when opening an .rdp file. they do not affect connections started manually within the Remote Desktop app.
Update Details and Compatibility
The new protections are available across both Windows 10 and Windows 11 through the following updates:
| Operating System | Update ID (KB) | Notes |
|---|---|---|
| Windows 11 | KB5083769 / KB5082052 | Available for versions 24H2 and 25H2 |
| Windows 10 | KB5082200 | Included in April 2026 updates |
For those setting up remote access, remember that the remote PC (the host) must be running the Windows Pro edition to enable Remote Desktop. Users can verify this by navigating to Settings > System > About and checking the Edition under Windows specifications. Once confirmed, Remote Desktop can be enabled via Settings > System > Remote Desktop.
Key Takeaways for Security
- Verify the Source: Never open RDP files received from untrusted or unexpected email sources.
- Review Permissions: Always check the new security dialog to see which local resources (like clipboards or drives) the remote connection is requesting.
- Keep Systems Updated: Ensure your devices have the latest cumulative updates to protect against CVE-2026-26151.
As phishing techniques evolve to abuse legitimate system tools, these “explicit consent” models are becoming essential. By removing silent resource sharing, Microsoft is shifting the burden of security from blind trust to informed user decision-making.