Free support ends October 14, 2025; new KB5063709 unlocks Extended Security Updates enrollment to keep critical patches flowing through October 2026.

Microsoft is warning Windows 10 users that free security updates end on October 14, 2025. A new cumulative update, KB5063709, enables a built-in enrollment flow for the Extended Security Updates (ESU) program, offering another year of fixes to October 13, 2026. Edge and WebView2 will still receive updates on Windows 10 until 2028.

With less than two months before Windows 10 reaches end of support, Microsoft has issued a final security warning: after October 14, 2025, no more free fixes. A fresh update, KB5063709, now exposes an “Enroll in Extended Security Updates” option inside Windows Update to help users secure one more year of patches.

• End of free support: Windows 10 (22H2) stops receiving free security updates on Oct. 14, 2025.
• Bridge program: Microsoft’s Consumer ESU extends security fixes to Oct. 13, 2026; enrollment is now available from Settings after installing KB5063709.
• Browser exception: Microsoft Edge and WebView2 Runtime will keep updating on Windows 10 through at least Oct. 2028—even if you don’t buy ESU.
• Scale: Windows 10 still represents roughly 43% of active Windows desktops worldwide (Statcounter, July 2025).

“After October 14, 2025… Microsoft will no longer provide security updates or fixes.” — Microsoft support page. Microsoft Support

“KB5063709… includes a fix for a bug that prevented enrollment in extended security updates.” — BleepingComputer (Aug. 12, 2025). BleepingComputer

“Edge and the WebView2 Runtime will continue to receive updates on Windows 10… until at least October 2028.” — Microsoft Edge lifecycle. Microsoft Learn

A separate storyline continues to roil the transition: a California lawsuit alleges Microsoft set the 2025 cutoff to push AI-ready PCs; Microsoft points to ESU as a safety net, but litigation underscores user anxiety about older, ineligible hardware.

What’s changing on Patch Tuesday:

• KB5063709 (Aug. 2025): Required to expose the ESU enrollment UI under Settings → Update & Security → Windows Update. It also resolves the enrollment-wizard crash and rolls in July’s security fixes (including one zero-day).

Enrollment mechanics (consumer ESU):

• Prereqs: Windows 10 22H2, admin rights, and Microsoft account sign-in (local accounts are not supported for ESU).
• Cost options: $30 one-year ESU, 1,000 Microsoft Rewards points, or free if you enable OneDrive settings sync—all visible in the built-in wizard after KB5063709.

Risk surface if you skip ESU:

• Unpatched remote code execution and privilege-escalation flaws accrue monthly across the kernel, Win32k, networking stack, printing, and driver ecosystems. Even with a supported browser, OS-level exposures (SMB, RPC, LSA, Credential Guard bypasses) remain unmitigated. (Derived from Microsoft monthly CVE cadence; see KB5063709 advisory context.)

Mitigations checklist (if you must remain on Windows 10):

1. Enroll in ESU and keep Windows Defender/EDR signatures current.
2. Harden attack surface: disable legacy protocols (SMBv1), restrict RDP, enforce LSA protection, and require smartcard/Windows Hello where possible. (General guidance aligned with Microsoft security baselines.)
3. Application control: enable ASR rules and Smart App Control-equivalents; prefer standard user rights.
4. Network containment: segment legacy Windows 10 devices; use firewall allow-lists and zero-trust access.
5. Browser updates: keep Edge/WebView2 current; isolate risky web apps in Application Guard where available.

Impact & Response

Who’s affected: Home users, SMBs, schools, and agencies still running Windows 10—hundreds of millions of devices globally. Statcounter shows Windows 10 usage near 43% in July 2025, meaning a large residual population will face patch gaps without ESU.

Actions to take now:

• Install KB5063709, then open Windows Update → Enroll in Extended Security Updates and choose a plan.
• Plan upgrades to Windows 11 24H2+ or supported alternatives; Microsoft reiterates Oct. 2025 as the firm cutoff for free updates.

Long-term implications: Expect shrinking driver/app support and rising exploit availability on unpatched systems, even as browsers continue to update through 2028.

Background

Microsoft set Windows 10 22H2 as the final feature version and has repeated the Oct. 14, 2025 deadline since 2023–24 guidance. ESU is designed as a temporary bridge, not a multi-year extension. Browser support to 2028 offers partial protection, but it does not replace OS security hardening.

• “ESU buys time—but not immunity. Treat it like a controlled exit ramp: enroll now, apply strict hardening (kill SMBv1, lock down RDP, enforce LSA protection), and move critical workloads to supported platforms within 12 months. The cost of delaying migration will be paid in incident response.” — El Mostafa Ouchen, cybersecurity author & practitioner.
• Microsoft (support notice):
  “After October 14, 2025… we will no longer provide security updates or fixes.”
• BleepingComputer (on KB5063709):
  “The update… fixes a bug that prevented enrollment in extended security updates.”
• Microsoft Edge team (lifecycle policy):
  “Edge and WebView2 will continue to receive updates on Windows 10 until at least October 2028.”

Conclusion

Microsoft’s warning is unambiguous: Windows 10’s free patch era ends on October 14, 2025. The KB5063709 + ESU path is a short-term safety measure to October 2026, not a strategy. Organizations and households should enroll if needed—but prioritize upgrading or retiring Windows 10 endpoints to reduce exposure as exploit pressure rises.

Russian-linked group EncryptHub is impersonating IT staff on Microsoft Teams, walking victims into remote sessions, then abusing CVE-2025-26633 (“MSC EvilTwin”) to execute rogue .msc consoles and drop Fickle Stealer. Microsoft patched the bug, but unpatched Windows endpoints remain at risk.

A new campaign weaponizes trust in collaboration tools. Attackers pose as IT on Microsoft Teams, coax employees into remote access, and run PowerShell that pulls a loader exploiting CVE-2025-26633 in Microsoft Management Console. The flaw—now added to CISA’s KEV—lets a malicious .msc run when its benign twin is launched. Patch and tighten verification controls immediately.

A social-engineering wave is turning Microsoft Teams into a beachhead. Adversaries masquerade as internal help-desk staff, request remote access, and execute PowerShell that fetches a loader which plants twin .msc files. When mmc.exe opens the legitimate console, Windows loads the attacker’s EvilTwin from the MUIPath directory, handing over code execution.

“Social engineering remains one of the most effective tools… attackers impersonate IT support, gain trust and remote access, and ultimately deploy suspicious tools,” Trustwave SpiderLabs reported. Trustwave

What’s new in this campaign

• Initial access via Teams impersonation. Operators send Teams requests as “IT” and guide the user into a remote session.
• PowerShell loader. Typical first command: powershell.exe -ExecutionPolicy Bypass … Invoke-RestMethod … runner.ps1 | iex, which drops twin .msc files.
• Exploit: CVE-2025-26633 / “MSC EvilTwin”—an MMC security-feature bypass that prioritizes a localized .msc in MUIPath (e.g., en-US) over the benign one. Patched by Microsoft in March 2025; listed by CISA KEV.
• Payloads and tooling. Fickle Stealer for data theft; SilentCrystal (Go loader) abusing Brave Support as a dropper; SOCKS5 backdoor for C2.

Demonstration (defender’s view, not exploit code)

1. The lure: A user accepts a Teams contact from “IT Support.” A remote session starts.
2. Command drop: Attacker runs a single PowerShell line (ExecutionPolicy Bypass) that downloads runner.ps1 from cjhsbam[.]com.
3. EvilTwin setup: The script writes two identically named .msc files; the malicious copy sits in …\System32\en-US (or a mock “C:\Windows␠\System32” with a trailing space), then mmc.exe loads the malicious one first.
4. Post-exploit: Persistence, AES-encrypted tasking over C2, and optional info-stealing via Fickle Steal

Why this works

• Trust channel abuse: Users expect help-desk on Teams; the UI looks familiar. Prior research shows Teams vishing has delivered RATs and ransomware before.
• Living-off-the-land: PowerShell + signed Windows binaries (mmc.exe) keep telemetry subtle.
• Path precedence edge case: The MUIPath lookup lets a malicious localized .msc hijack execution—now patched, but effective on lagging fleets.

“Treat every ‘IT support’ request in Teams as untrusted until proven otherwise. Make users verify out-of-band, and make admins verify the OS. If your estate isn’t patched for CVE-2025-26633, you’re one click away from handing attackers mmc.exe on a silver platter. Block the social angle, patch the technical angle, and hunt for ExecutionPolicy Bypass like your business depends on it—because it does.” — El Mostafa Ouchen

Immediate actions (enterprise)

1) Patch priority

• Deploy March 2025 Windows updates that remediate CVE-2025-26633 across client and server. Validate compliance in WSUS/Intune/ConfigMgr; confirm exposure via MSRC / NVD.

2) Harden Teams trust boundaries

• Restrict External Access to allow-list domains; disable unsolicited chats from unknown tenants.
• Create a help-desk verification policy: no remote control unless the user initiates via the corporate portal/ticket, plus callback via a known internal number. (Microsoft and industry advisories consistently warn about tech-support impersonation.)

3) Detections to turn on today

• PowerShell: alert on -ExecutionPolicy Bypass, Invoke-RestMethod, DownloadString, or Invoke-Expression launched from Teams, Teams.exe child, or interactive sessions.
• MMC/EvilTwin indicators:
  • mmc.exe loading .msc from MUIPath (…\System32\en-US*.msc) or paths with trailing spaces (e.g., C:\Windows␠\System32).
  • Unexpected writes to localized .msc directories.
  • New .msc files followed by immediate mmc.exe execution.

Sample KQL (Microsoft Defender XDR)

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-ExecutionPolicy Bypass","Invoke-RestMethod","Invoke-Expression","DownloadString")
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, bin(TimeGenerated, 1h)

DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "mmc.exe"
| where FolderPath has_any (@@"\System32\en-US\", @"\Windows \System32") // note the space before \System32
| summarize count() by DeviceName, FolderPath, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)

4) Reduce blast radius

• Enforce ASR rules (e.g., block Office/Win32 child processes), Constrained Language Mode where feasible, and Device Control to prevent unauthorized admin tools.
• WDAC/AppLocker: explicitly allow only known-good .msc; deny execution from localized resource folders and user-writable paths.

5) People & process

• Run an awareness micro-module: “Never accept unsolicited remote-access on Teams. Verify via ticket + callback.”
• Table-top a scenario: help-desk impersonation → PowerShell dropper → MMC exploit → C2.

Indicators & context

• Domains/paths seen: cjhsbam[.]com, rivatalk[.]net, safesurf.fastdomain-uoemathhvq.workers.dev; twin .msc technique; AES-tasking over C2; SilentCrystal loader; SOCKS5 backdoor.
• Attribution & scope: EncryptHub (aka LARVA-208 / Water Gamayun) active since 2024; >600 orgs claimed impacted in reporting.

The bigger picture

Abuse of “work-trusted” channels (Teams, Slack, Quick Assist) is now routine in ransomware and stealer operations. Recent cases show Teams vishing setting up RAT installs and “support” sessions that end in domain compromise. The platform isn’t the problem; trust without verification is.

Bottom line

This campaign fuses social engineering with a Windows path-precedence quirk. If you patch CVE-2025-26633, lock down Teams external contact, verify support out-of-band, and hunt for Bypass-heavy PowerShell, you turn a high-probability breach into a blocked pop-up.

One-Page SOC Playbook (Teams “Request Remote Access” abuse)

Detect, contain, and prevent Teams-led social engineering that results in malicious .msc execution and data theft.

1) Patch & Exposure

• Deploy the March 2025 Windows updates addressing CVE-2025-26633 to all supported builds.
• Verify posture via WSUS/Intune/ConfigMgr compliance reports; track exceptions with a 48-hour SLA.

2) Microsoft Teams Guardrails

• External Access: Move to allow-list of trusted tenants; disable unsolicited chats from unknown domains.
• Support workflow: No remote control unless initiated from the corporate portal/ticket, plus callback verification from a published internal number.
• Education: 10-minute module: “Never accept unsolicited remote access.”

3) Detections to Enable (Microsoft Defender XDR – KQL)

A. PowerShell dropper patterns (bypass + web fetch):

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-ExecutionPolicy Bypass","Invoke-RestMethod","Invoke-Expression","DownloadString","iwr","iex")
| project Timestamp=TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName
| order by Timestamp desc

B. Teams as the launchpad (PowerShell child of Teams):

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName has_any ("Teams.exe","ms-teams.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountSid, AccountName
| order by TimeGenerated desc

C. MMC loading suspicious .msc (localized folders / path tricks):

DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "mmc.exe"
| where FolderPath has @"\System32\en-US\" or FolderPath has @"\Windows \System32" // note possible trailing space
| project TimeGenerated, DeviceName, FolderPath, InitiatingProcessCommandLine
| order by TimeGenerated desc

D. Unexpected .msc file writes (resource folders):

DeviceFileEvents
| where FileName endswith ".msc"
| where FolderPath has @"\System32\en-US\"
| where InitiatingProcessFileName in~ ("powershell.exe","wscript.exe","cscript.exe")
| project TimeGenerated, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

4) Containment & Hardening

• Isolate device in EDR if any rule above fires + user confirms unsolicited “IT” contact.
• Revoke tokens (AAD sign-ins, OAuth grants) and reset credentials from a known-clean host.
• ASR rules: Block abuse of LOLBins (Office child processes, script abuse); audit → enforce.
• WDAC/AppLocker: Allowlist known-good .msc; deny execution from localized resource folders and user-writable paths.
• PowerShell CLM where feasible; log Script Block/Module events to SIEM.

5) Comms & Aftercare

• Notify impacted users; provide a one-page “verify IT requests” reminder.
• Run retro hunt for the past 30–60 days with the KQL above; export findings for IR.
• Add the scenario to quarterly table-top: Teams impersonation → remote session → PowerShell → MMC hijack.

KPIs: Patch compliance ≥98% within 72h; zero unsolicited remote-access approvals; MDE detections triaged <1h; mean-time-to-isolation <15m.

Sources:

• CyberSecurityNews: Teams impersonation + remote access flow and runner.ps1 details. Cyber Security News
• Trustwave SpiderLabs: technical breakdown (EvilTwin, MUIPath precedence, SilentCrystal, IOCs). Trustwave
• Trend Micro: CVE-2025-26633 “MSC EvilTwin” analysis and Water Gamayun/EncryptHub link. Trend Micro
• NVD/MSRC: CVE-2025-26633 description and references. NVDMicrosoft Security Response Center
• CISA: KEV listing/alert for CVE-2025-26633. CISA
• Fortinet: Fickle Stealer capabilities/background. Fortinet

What Pegasus actually does

Pegasus is a commercial “mercenary” spyware suite by NSO Group that covertly compromises iOS and Android devices, enabling data theft (messages, photos, tokens), live microphone/camera activation, and location tracking—often without any user action. Independent labs have repeatedly linked infections to zero-click exploit chains (no tap, no click) delivered through system parsers like iMessage / ImageIO and Wallet/PassKit.

“This is not phishing-at-scale; it’s precision exploitation of core parsers that touch your device even when you never tap the message.” — Mobile security researcher summary of zero-click risk, based on Citizen Lab and Project Zero analyses.

How infections happen

1. Targeting & delivery
   • Operator selects a high-value target (journalist, lawyer, official). Payloads arrive via iMessage (e.g., FORCEDENTRY 2021; BLASTPASS 2023) or other channels. In earlier eras, links (SMS/DM) and network-injection on hostile networks were also observed.
2. Exploit chain (parser abuse)
   • Crafted images or containers trigger bugs in ImageIO/Wallet (PassKit) or iMessage’s pipeline, pivoting to kernel-level code execution. (Examples: CVE-2021-30860/FORCEDENTRY; CVE-2023-41064 & CVE-2023-41061/BLASTPASS.)
3. Post-exploit implant
   • Implant establishes C2, escalates privileges, and begins exfiltration. Infrastructure rotates frequently (throwaway domains / short-lived servers) to reduce forensic footprint.
4. Persistence (it depends)
   • Historic Pegasus (2016 “Trident”) used true persistence tricks; later waves often avoid persistence on iOS (cleared by reboot) to lower forensic risk—operators can just re-exploit. On Android, some cases may survive factory reset, hence “replace device” is sometimes advised after confirmed compromise.

Why Apple’s Lockdown Mode matters

For BLASTPASS (2023), Citizen Lab and Apple stated that Lockdown Mode blocks that chain. Lockdown trims high-risk parsers and attachment handling—hugely valuable for at-risk roles.

“Demonstration” (safe): How defenders test & investigate

A) Quick risk-reduction drill (any high-risk iPhone)

1. Update iOS/macOS immediately (enable auto-updates + Rapid Security Responses).
2. Enable Lockdown Mode (Settings → Privacy & Security → Lockdown Mode → Turn On).
3. Harden iMessage workflow (minimize unknown senders; limit content previews).
4. Daily reboot is not a fix, but can disrupt non-persistent implants and surface anomalies in logs between reinfection attempts.

B) Basic forensics with MVT (Mobile Verification Toolkit)

This is for defenders on devices you own/manage or with explicit consent.

1. Prepare an iOS backup (unencrypted Finder/iTunes backup).
2. Run MVT against the backup with published indicators (STIX/TI from trusted labs):

# Example (macOS/Linux workstation)
python3 -m pip install mvt-ios
mvt-ios check-backup --iocs path/to/pegasus-indicators.stix2 ./path/to/ios_backup

3. Interpret results: Hits require expert review; absence of hits ≠ clean bill of health. Consider full-device acquisition by a professional lab if you have an Apple threat notification.

C) If you receive an Apple threat notification

• Do not wipe; preserve evidence.
• Move sensitive work to a known-clean device.
• Engage experts/NGOs (e.g., digital security helplines) for MVT-based analysis.
• Keep Lockdown Mode enabled; patch promptly.

Concrete, layered protections (orgs & individuals)

For everyone

• Keep OS/apps current; remove unknown configuration profiles; avoid sideloading.
• Use hardware security keys/app-based 2FA; rotate passwords on a separate, clean device after incidents. (Best practice.)

For high-risk users / orgs

How Pegasus changed over time (key milestones)

• 2016 “Trident”: link-based chain with true persistence on iOS (Lookout/Citizen Lab).
• 2020–2021 “KISMET/Great iPwn/FORCEDENTRY”: large move to zero-click iMessage.
• 2022–2023: multiple iOS 15/16 zero-click chains; BLASTPASS via PassKit images; Lockdown Mode blocks that chain.

“Pegasus turned smartphones into pocket informants. The answer isn’t panic—it’s discipline: patch fast, enable Lockdown Mode for high-risk roles, and use professional forensics rather than guesswork. Treat an Apple threat alert like smoke from a fire alarm—investigate with experts before the evidence disappears.” — El Mostafa Ouchen

TL;DR: What to do right now

• Update and enable Lockdown Mode if you’re high-risk.
• Establish an IR path: preserve evidence, MVT scan, expert help on notification.
• Assume reinfection attempts until patched; don’t rely on “factory reset” (Android may persist; iOS often re-exploited).

Sources for further reading

Citizen Lab on FORCEDENTRY (CVE-2021-30860) and BLASTPASS; Google Project Zero technical deep-dive; CERT-EU CVE brief; Amnesty’s MVT docs; Apple’s mercenary-spyware threat notification guidance. The Citizen LabHelp Net SecurityProject Zerocert.europa.euAmnesty InternationalGitHubmvt-docs.readthedocs.ioApple Support