When I review Microsoft 365 tenants, phishing defenses still tend to revolve around macro-enabled Office files. Microsoft's report from a few days ago shows how far attackers like Midnight Blizzard have moved beyond that. Their large-scale campaign attached signed .rdp files to emails and counted on users double-clicking them without a second thought. That one click starts the local Remote Desktop client, which connects directly to a server the attacker controls and often exposes drives, the clipboard and other resources. If RDP is part of everyday work in your environment and you don't block RDP files, you are leaving a door wide open.
Midnight Blizzard turns signed RDP attachments into a phishing weapon
The attack works so well because it combines a technical gap with ordinary human curiosity. The emails are tightly targeted and carry digitally signed .rdp files. The signature gets them past many attachment filters and makes them look trustworthy to the recipient. Once someone opens the file, the local RDP client quietly connects to an internet host run by the attacker, in some cases with drives or the clipboard fully mapped. From there, stealing data or delivering malware is easy, and all it took was a double-click. Microsoft published a detailed analysis of the campaign (blog post from October 29).
Blocking RDP files starts at the mail gateway and continues on the device
The first and most effective step is to stop these attachments at the email gateway. In Exchange Online, the anti-malware policy in Microsoft Defender for Office 365 has a "common dangerous attachments" filter. Right now .rdp is on that list by default, but custom or older policies may still let these files through. Check the setting in the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-malware (Microsoft documentation).
Practical tip: Even if you're sure .rdp files are already blocked, go through every custom attachment filter in your tenant. Forgotten or outdated policies regularly allow risky file types again, and nobody notices.
Mail filtering only gets you part of the way. Outbound RDP (TCP 3389) should also be blocked at the network perimeter and in endpoint firewalls, and that applies to mobile devices in particular. Where remote access is genuinely needed, limit it to dedicated, hardened hosts with known IP addresses. On managed Windows devices you can go further with Group Policy or Intune: require RDP files to be signed by trusted publishers and, ideally, stop users from opening .rdp files from unknown sources at all. That takes away most of the room these phishing techniques need.
Advanced Hunting in Defender XDR finds RDP attachments in your mail flow
The good news is that these attacks leave traces. With Microsoft Defender XDR (Defender for Office 365 Plan 2 or Microsoft 365 E5, security reader or higher), Advanced Hunting lets you search for emails that carried .rdp attachments. Open the Microsoft Defender portal → Hunting → Advanced hunting and run this KQL query:
EmailAttachmentInfo
| where FileType == "rdp" or FileName endswith ".rdp"
I use the results to set up alerts, look more closely at accounts that seem at risk, or check what end users actually did. If something points to a compromise, Defender for Endpoint or the Windows event log gives you the endpoint view to follow up. The documentation for the EmailAttachmentInfo table has more detail.
The defenses form a chain from inbox to firewall
The diagram below shows how the controls fit together, starting when the email arrives and ending with a possible connection from the device. At each step there's a chance to stop a malicious RDP file:
flowchart TD
Email["Email with .rdp attachment"] --> Filter["Anti-malware filter Exchange Online"]
Filter -- "blocked" --> Deleted["Email quarantined"]
Filter -- "not blocked" --> User["User opens attachment"]
User --> RDPClient["RDP client starts connection"]
RDPClient --> Firewall["Firewall checks destination"]
Firewall -- "outbound blocked" --> Denied["Connection denied"]
Firewall -- "allowed" --> Risk["Access to attacker server"]
Figure: The defense chain for malicious RDP files, where every step counts.
User awareness has to keep pace with new phishing tactics
Like so many attacks, this one is only half a technical problem. Users still play a big part. Most employees have no idea that an .rdp file can be dangerous, which makes them an easy target for a well-made phishing email. Training should cover this scenario explicitly and state plainly that opening an RDP file from an email is never safe, signed or not. For related risks and further mitigation, see my articles on AiTM phishing in Entra ID and Defender for Office 365 preset policies. Attackers keep coming up with new tricks, and we have to keep adapting too.
My take: if you block RDP files, keep network controls tight and make sure users know about new phishing tactics, your tenant will be in much better shape for the rest of 2024. None of these measures is perfect by itself, but combined they make a real difference.
