RDP files are a credential and file theft path, not just a convenience feature. Microsoft is now forcing Windows to warn before opening them and to disable risky resource redirection by default, because a malicious file can silently connect a user to an attacker-controlled system and expose local drives, clipboard data, and authentication material.
The change ships in the April 2026 cumulative updates for Windows 10 KB5082200 and Windows 11 KB5083769 and KB5082052. Microsoft says the new prompts are meant to stop phishing abuse of .rdp files, a technique previously used by APT29 to steal data and credentials from victims.
The protection reduces easy exfiltration through redirected devices, but it can also interrupt admin workflows that depend on redirected resources. The remaining risk is that users still have to recognize and reject malicious connection files before they become a live session.
Windows is getting stronger RDP file protections to fight phishing attacks - Help Net Security
Microsoft has introduced new Windows protections starting with the April 2026 security update to reduce phishing attacks that abuse Remote Desktop (.rdp)
Microsoft adds Windows protections for malicious Remote Desktop files
Microsoft has introduced new Windows protections to defend against phishing attacks that abuse Remote Desktop connection (.rdp) files, adding warnings and disabling risky shared resources by default.