The just-released Windows 11 22H2 brings a new security feature called Enhanced Phishing Protection that warns users when they enter their Windows password in insecure apps or websites.
See also: Windows 11 22H2 released: See the new features
Windows login credentials are valuable to malicious actors, as they allow them to access internal corporate networks for data theft or ransomware.
These passwords are typically obtained through phishing or by users who store their passwords in insecure applications, such as word processors, word processors, and spreadsheets.
In some cases, simply typing your password into a phishing login form and not submitting it is enough for it to be stolen by threat actors.
To combat this behavior, Microsoft introduced a new feature called "Enhanced Phishing Protection" that warns users when they enter their Windows password on a website or enter it into an insecure application.
This new feature is only available in Windows 11 22H2 at this time and is not enabled by default. It also requires you to sign in to Windows with your Windows password instead of using Windows Hello.
So, if you use a PIN to sign in to Windows, this feature won't work.
See also: Windows 11: Provides better protection against SMB brute-force attacks
When enabled, Microsoft will detect when you enter your password in Windows and then issue a warning asking you to remove the password from an insecure file or, if it has been entered on a website, change your Windows password.
While Windows 11 22H2 has phishing protection enabled by default, the options to protect your passwords are disabled.
To enable these options, go to Start > Settings > Privacy & Security > Windows Security > App & Browser Control > Reputation-based protection settings.
In the Phishing Protection section, you will see two new options labeled “Warn about password reuse” and “Warn about insecure password storage.”
When enabled, the “Warn about password reuse” option will display a notification when you enter your Windows password on a website, whether it’s a phishing site or a legitimate one.
The “Warn about insecure password storage” option will alert you when you type your password in an application like Notepad, Wordpad, and Microsoft Office and then press enter.
See also: Windows 11 22H2: Users report gaming issues
To protect your passwords, put a check mark in both options to enable them. When you enable either option, Windows 11 will display a UAC prompt, which you will need to accept.
However, the Enhanced Phishing Protection feature does not seem to work through Mozilla Firefox.
