Windows Zero-Day Vulnerability: Credential Theft Across Windows Versions

Overview

A critical zero-day vulnerability affecting all supported versions of Windows, from Windows 7 through Windows 11, and Windows Server 2008 R2 onwards, has been discovered. This flaw allows attackers to steal NTLM (NT LAN Manager) credentials by exploiting maliciously crafted Windows Theme files. By leveraging this vulnerability, attackers can intercept sensitive credentials with minimal user interaction.

How the Vulnerability Works

The exploit involves Windows Theme files that include references to external network paths. When a user previews or interacts with these files, Windows automatically sends NTLM authentication requests to the specified external server. These authentication requests, containing hashed credentials, can be intercepted and used in pass-the-hash attacks or relayed to gain unauthorized access to systems.

Impacted Systems

This vulnerability impacts:

• All desktop versions of Windows, from Windows 7 through Windows 11 (including Windows 11 24H2).
• Windows Server versions, starting from 2008 R2 and onward.

Mitigation and Protection

Microsoft has not yet released an official patch for this vulnerability. However, temporary fixes and third-party solutions are available to mitigate the risk:

• ACROS Security’s Micropatch: This patch prevents NTLM credential leaks by identifying and blocking malicious network paths in theme files.
• Group Policy Settings: Disable NTLM authentication where possible and enforce modern authentication protocols like Kerberos.
• Antivirus and Monitoring Tools: Ensure that antivirus software is updated and actively monitoring for malicious theme files.
• User Education: Educate users to avoid downloading or interacting with untrusted Windows theme files.

Conclusion

This zero-day vulnerability highlights the ongoing risk posed by legacy authentication protocols like NTLM. Until an official patch is released, organizations and users must adopt mitigation strategies to safeguard their systems and credentials. Keeping systems updated and applying temporary patches can significantly reduce exposure to this exploit.