Microsoft this week announced that the preview feature is now disabled in Windows’s File Explorer for files downloaded from the internet, as an additional protection against NTLM hash leaks. The change, rolled out as part of the October 2025 Patch Tuesday security updates, applies to all files that are marked with Mark of the Web (MotW). Windows adds the MotW to files fetched via browser downloads or email attachments and warns users of the potential risk these files pose. For Office files, the system blocks macros, which could contain malicious code. By disabling the preview of files downloaded from the internet, Microsoft seeks to prevent a security defect leading to NTLM hash leaks when a potentially unsafe file is previewed. Attackers can brute-force the leaked hash to retrieve a…