Suspicious NTLM Authentication Triggered by Snipping Tool - Potential CVE‑2026‑33829 Exploitation

Chamath Rathnasekara@chamathr

•updated Apr 23, 2026•31•0•623

Detects potential NTLM credential leakage caused by SnippingTool.exe making outbound network connections (SMB / Web) that result in NTLM authentication, consistent with CVE‑2026‑33829 exploitation.