Hacks – May 2022 – Follina Zero Day Vulnerability

Share This Post

Tips and Tricks to mitigate and prevent “Follina”:

  • Turn off the preview pane in file explorer and Microsoft Outlook.
    • File explorer – go to the View menu tab, if preview pane is highlighted, click it to disable
    • Microsoft Outlook –
      • File Options Trust Center > Trust Center Settings,and then select Attachment Handling.
      • Click Turn off Attachment Preview
    • Always verify the sender of an email.
    • Hover over hyperlinks before clicking them to reveal their true location.
    • Never open an attachment you are unsure of.

References:

https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug?hstc=1139630.416896d61b0745d0044e9a03af7f82ad.1653955273132.1653955273132.1653955273132.1&_

hssc=1139630.1.1653955273132&__hsfp=3244405923&hsutk=416896d61b0745d0044e9a03af7f82ad&contentType=listing-page

https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

https://support.microsoft.com/en-us/office/preview-attachments-in-outlook-6f61e4ad-a93d-408c-bb3a-bc95107f66be

https://threatpost.com/zero-day-follina-bug-lays-older-microsoft-office-versions-open-to-attack/179756/

https://www.reddit.com/r/msp/comments/v0tuvs/ms_office_vuln_polite_warning_about_nearterm/

More To Explore

cyber-security

Excite Cyber Whitepaper – Data Loss Prevention (DLP) as an Enabler for Secure AI Adoption

AI has moved from experiment to operating model, but its real value—and risk—comes down to your data. With 75% of knowledge workers already using AI tools, often without IT oversight, shadow AI is driving a costly wave of breaches that organisations can’t afford to ignore. This whitepaper cuts through the anxiety to show how Microsoft Purview gives you the discovery, classification, and policy controls to make AI safe and productive, turning data security from a blocker into an AI enabler.

cyber-security

Excite Cyber Threat Intelligence Report – Q1 2026

Q1 2026 has been defined by speed. Storm-1175, a financially motivated affiliate of the Medusa ransomware-as-a-service operation, has emerged as the quarter’s most aggressive threat to Australian businesses, weaponising newly disclosed vulnerabilities in internet-facing systems and moving from initial breach to full ransomware deployment in as little as 24 hours.