Oops I UDL'd it Again

This blog-style report describes a phishing technique that leverages legacy Windows UDL files to trigger authentication attempts (or solicit typed credentials) when a user clicks 'test connection', enabling capture of NetNTLMv2 hashes via tools like Responder; it explains UDL internals, how to modify Responder to listen on alternate ports (e.g., 80) to increase success, and notes limitations such as outbound port blocking and likely future mitigations by vendors.