Researchers identified evidence of exploitation on April 7, 2022—before the issue was publicly recognized—which makes that date the timeline anchor for Follina. The chronology that followed is unusually revealing about disclosure friction: a researcher using the name CrazymanArmy reported the behavior to Microsoft on April 12, and, per researcher and media reporting, Microsoft initially classified it as not security-related. Nao_Sec then found a malicious document on VirusTotal on May 27, Microsoft issued guidance on May 30, and the security update arrived on June 14, with defense-in-depth changes following in July.
Follina's lasting shock was conceptual. Organizations had spent years training users and disabling Office macros. Follina walked around that entire defense by using a Windows protocol handler instead.
CVE-2022-30190 is a vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT), invoked through the ms-msdt: URL protocol. The NVD-derived record lists a broad Windows footprint—Windows 7, 8.1, multiple Windows 10 releases, Windows 11 21H2, and Windows Server editions from 2008 R2 through Server 2022. Exploitation was observed through Office documents, including Office 2013, 2016, 2019, 2021 and Microsoft 365 Apps.
The class is remote code execution through an application invoking MSDT with attacker-controlled protocol data. The CVSS assessment cited is 7.8 (High), with a local attack vector and required user interaction. That vector detail matters for how the incident should be described—it is not an unauthenticated, no-interaction network exploit.
The disclosure chronology is worth keeping straight, because it is unusually messy. The earliest specifically reported exploitation evidence dates to April 7, 2022. A researcher using the name CrazymanArmy reported the behavior to Microsoft on April 12, 2022; per reporting, Microsoft initially classified it as not security-related. The issue then re-emerged publicly when the group Nao_Sec found a malicious document on VirusTotal on May 27, 2022, drawing broad attention. Microsoft published guidance on May 30 and shipped the security update on June 14, with further defense-in-depth changes in July. Those are five distinct dates—exploitation, private report, public rediscovery, acknowledgment and patch—and collapsing them into a single "disclosure" would misrepresent how long the technique circulated before it was fixed.
A crafted Office document could reference an external HTML resource. The retrieved content then invoked the registered ms-msdt: URI handler, passing parameters that caused the diagnostic tool to launch commands—commonly through PowerShell.
The important trust transition was between document rendering and a privileged operating-system helper. Office did not need to run a traditional macro; it handed a specially formed URI to Windows, which treated the scheme as a request to launch MSDT. Code ran with the privileges of the calling application, and therefore of the logged-on user.
Some delivery paths could be triggered by document preview, reducing the interaction required beyond selecting or viewing a file. That does not make every Follina attack zero-click, however: the NVD vector requires user interaction, and the observed attacks typically depended on delivery and handling of a malicious document. Overstating this as universally zero-click would misstate the record.
The earliest reported samples impersonated Russian news agencies. After the technique drew public attention, multiple actors used Follina to deliver information stealers, remote-access tools, backdoors and ransomware-related payloads.
Reporting linked exploitation to TA413, described as a Chinese state-sponsored actor, and to TA570, associated with Qbot activity. These are examples of users of the technique—not evidence that one actor discovered or controlled every campaign. The distinction keeps the attribution honest: a shared technique adopted broadly is different from a single operator's tool.
The supplied evidence establishes exploitation by multiple actor types but does not provide an authoritative victim count. Payload reports include Cobalt Strike, credential-harvesting tools and other backdoors. Those payload observations should not be converted into confirmed compromise totals.
Follina's practical impact was the bypass of a common policy assumption: disabling Office macros did not prevent a document from reaching executable system functionality through a protocol handler. For defenders who had treated "macros off" as a near-complete answer to malicious documents, that was a meaningful correction.
Detonating malicious Office samples and capturing process trees belongs in a disposable, isolated VM lab. The Samsung T7 Portable SSD gives analysts fast external storage for snapshots, sample archives and offline sandboxes.
Amazon Affiliate Link
Before the patch, Microsoft recommended disabling the MSDT URL protocol by removing the HKEY_CLASSES_ROOT\ms-msdt registry key after backing it up. The workaround prevented troubleshooters from launching through links but did not disable all troubleshooting functions.
Microsoft released corrective security updates on June 14, 2022, and additional defense-in-depth changes in July. Defender products received signatures and behavior detections for malicious documents, URLs and endpoint activity. Useful detection focused on unusual parent-child process relationships—particularly Office applications spawning msdt.exe—and on suspicious PowerShell execution.
Follina showed how custom URI schemes can become unexpected execution boundaries. Security controls focused on macros or embedded executables simply did not cover an Office document that delegated execution to an operating-system diagnostic component.
It also illustrated disclosure-process risk. Reporting says the issue was initially dismissed despite malicious samples, then re-emerged publicly roughly six weeks later. That sequence belongs in the story as sourced reporting, while Microsoft's eventual advisory and patch record stand on their own. The line that captures the incident: macros were off, but the operating system still answered the document's call.