Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
New Windows Update Targets RDP Phishing Threats with Security Alerts

New Windows Update Targets RDP Phishing Threats with Security Alerts

Written By Anoop C Nair
Last Updated April 21, 2026
Posted In Security
SHARE

Key Takeaways

  • RDP Phishing Threats with Security alerts now available
  • Microsoft added new security warning dialogs for .rdp files in Windows (April 2026 update).
  • Unknown or unsigned .rdp files now trigger a “Caution: Unknown remote connection” alert.
  • Resource sharing (clipboard, drives, printers, credentials) is disabled by default.
  • Users must manually approve each permission before connecting.

In this post, we are discussing, New Windows Update Targets RDP Phishing Threats with Security Alerts. Microsoft’s April 2026 Patch Tuesday update introduces a major security change to the Remote Desktop Connection (MSTSC) application, aiming to reduce phishing attacks that exploit .rdp files. These files are commonly used to launch remote sessions, but they have attacked by attackers to silently redirect users to malicious systems.

Table of Contents

New Windows Update Targets RDP Phishing Threats with Security Alerts

The new update introduces warning dialogs that appear when users open .rdp files, especially when the file publisher is unknown. This is designed to stop users from unknowingly connecting to attacker-controlled infrastructure through manipulated connection files.

Important of this Update

Hackers were using .rdp files (Remote Desktop files) in phishing attacks. These files look normal, so users think they are safe and open them without suspicion. But when opened, these files can secretly connect the user to a fake remote computer controlled by attackers. While connected, they may also try to access sensitive things like your clipboard, files, or login details.

  • So, Microsoft added this update to stop users from being tricked easily and to make sure people clearly see a warning before connecting to anything unsafe.
New protections
Shown once per account, explaining what .rdp files are and why they’re risky.
Shown every time an .rdp file is opened, displaying the remote computer’s address, publisher verification, and requested resource redirections.
All resource redirections (drives, printers, smart cards, etc.) are disabled by default. Users must explicitly enable them.
New Windows Update Targets RDP Phishing Threats with Security Alerts -Table.1

How this Helpful for Users

After the update, Windows now shows an initial education dialog the first time an .rdp file is opened. This explains what RDP files are and warns about potential risks. Every subsequent connection triggers a security dialog that displays the remote address, publisher status, and all requested resource redirections. By default, all redirection options are turned Off and must be manually enabled.

Patch My PC

The below screenshot is from our post: Download AVD Session Desktop RDP File RDPW File to Check RDP Settings

New Windows Update Targets RDP Phishing Threats with Security Alerts -Fig.1
New Windows Update Targets RDP Phishing Threats with Security Alerts -Fig.1

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community  and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well

Author

Anoop C Nair is a Workplace Technology solution architect with 25+ years of experience. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He is a blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, and Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Entra, and Microsoft Security

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Security

Microsoft Fixes 570 Security Vulnerabilities and 3 Zero-Day Vulnerabilities in July 2026 Patch Tuesday

Key Takeaways Microsoft Fixes 570 Security Vulnerabilities and 3 Zero-Day Vulnerabilities in July 2026 Patch Tuesday! Microsoft fixed 3 zero-day vulnerabilities as part of the July 2026 Patch Tuesday updates. Two of them, CVE-2026-56164 (Microsoft SharePoint Server Elevation of Privilege) and CVE-2026-56155 (Active Directory Federation Services Elevation of Privilege), were actively exploited before the security […]

AC Anoop C Nair 29 min read
Security

Critical Vulnerabilities You Must Patch Immediately | Full May CVE List Included

Key Takeaways 2026 May Security Update! Microsoft released the May 2026 Patch Tuesday security updates with fixes for 120 vulnerabilities and no publicly disclosed zero-day vulnerabilities. This month’s release includes 17 Critical vulnerabilities, including 14 Remote Code Execution (RCE) flaws, 2 Elevation of Privilege vulnerabilities, and 1 Information Disclosure vulnerability. 2026 May Security Update | […]

AC Anoop C Nair 15 min read
Security

New GhostLock Technique Exploits Windows API to Block File Access

Key Takeaways In this post we are discussing New GhostLock Technique Exploits Windows API to Block File Access. Recently, security researchers introduced a new proof of concept tool called GhostLock that demonstrates how legitimate Windows file handling features can be abused to block access to files stored locally or on SMB network shares. New GhostLock […]

AC Anoop C Nair 3 min read