ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “microsoft-defender”

25 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAll
SeverityAllcritical 0high 0medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ShieldCrash PoC: Microsoft Defender Fix Bypass

A ShieldCrash proof-of-concept bypasses Microsoft's patch for CVE-2026-69414, a high-severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine.

Microsoft previously fixed CVE-2026-69414 (ShieldBreak), a high-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. SOCRadar now reports a new proof-of-concept dubbed ShieldCrash demonstrating that the published fix can be bypassed. The available source text does not detail affected versions or whether the bypass has been used in real attacks.

SOCRadar · 5d agoExploit / PoC 4 sourcesCVE-2026-69414

New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.

An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.

BleepingComputer · 7d agoExploit / PoC

New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM

Researcher's ShieldCrash PoC claims Microsoft Defender still allows arbitrary file reads as SYSTEM on patched Windows, bypassing the CVE-2026-69414 fix.

Researcher MSNightmare released the ShieldCrash proof of concept showing Microsoft Defender can allegedly be made to read arbitrary files with SYSTEM privileges on fully patched Windows systems, bypassing the September 2026 fix for ShieldBreak (CVE-2026-69414). Microsoft has not confirmed the bypass, and the new flaw has no CVE assignment yet. The PoC repository contains C++ project files, a Warden.dll library, and an EICAR test archive, suggesting interaction with Defender's malware-detection and file-handling workflow. Reading files as SYSTEM could expose configuration files, credentials, private keys, and other users' data, though it does not enable code execution.

Cyber Security News · 7d agoVulnerabilityCVE-2026-69414

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker News · 25d agoToolsCVE-2021-240921

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.

Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.

GBHackers · 7d agoExploit / PoCCVE-2026-69414

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security Affairs · 7d agoExploit / PoCCVE-2026-69414

Counterfeit installers turn routine software downloads into enterprise breaches

Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.

Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.

CSO Online · 13d agoThreat actor in the wild1

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.

Microsoft says an active campaign uses counterfeit vendor websites on .com.cn and .hl.cn infrastructure with Chinese-language lures to deliver server-side generated installers that establish scheduled-task persistence, add Defender exclusions, delete shadow copies, and stop services including wuauserv, UsoSvc, uhssvc and WaaSMedicSvc. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations of multinationals and Chinese-speaking users. Microsoft assesses with moderate confidence the activity matches the Silver Fox (Yinhu) cluster, historically tied to Gh0st RAT and ValleyRAT, with C2 over non-standard ports like 5090 and 7088-7090 via domains iualef[.]net and oijfwe[.]net. Kaspersky separately detailed a QN Wallpaper DLL-sideloading chain delivering ValleyRAT.

The Hacker News · 13d agoMalware in the wild

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.

The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.

The Hacker News · 7d agoExploit / PoCCVE-2026-694141

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark Reading · 5d agoExploit / PoC1

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security Blog · 14d agoThreat actor in the wild1

Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.

Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.

Microsoft Security Blog · 5d agoPhishing & fraud in the wild1

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Check Point shows attackers can abuse Microsoft Defender's signed remediation driver for arbitrary Ring 0 file and registry operations without exploiting any vulnerability.

Check Point Research presents BTR Reforged, a technique that repurposes Microsoft Defender's trusted remediation driver into an attacker-controlled kernel operation primitive. The signed driver can be instructed to execute arbitrary file and registry operations from Ring 0 without exploits, vulnerabilities, or memory corruption. The work demonstrates how trusted security components can be turned into attacker primitives, which is relevant for defenders assessing driver abuse risks.

Check Point Research · 26d agoResearch

The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced

GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.

The roundup scores 12 enterprise endpoint protection vendors across detection, EDR depth, management, pricing transparency, and platform coverage. CrowdStrike and Bitdefender tie at 8.8, with Microsoft Defender for Endpoint scoring 8.5 and noted as effectively free for Microsoft 365 E5 licensees. The piece also flags that Kaspersky cannot legally be sold in the US and that Panda and Webroot now sit under WatchGuard and OpenText respectively.

GBHackers · 8d agoIndustry 2 sources1

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Microsoft was named a leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, cited for Defender for Cloud runtime security.

The 2026 Frost Radar for Cloud Workload Protection Platforms placed Microsoft in its leadership tier, calling the company a visionary leader. Microsoft attributes the recognition to unified runtime security delivered through Microsoft Defender for Cloud. The post is vendor marketing with no incident, vulnerability, or technical detail.

Microsoft Security Blog · 27d agoIndustry2

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated · 1h agofirst · 3h agoIndustry 13 sources

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security Affairs · Aug 12, 2026Exploit / PoCCVE-2026-50656

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News · 1d agoTools

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security News · 7d agoIndustry

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.

Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.

Help Net Security · Aug 12, 2026Exploit / PoC in the wildCVE-2026-68820CVE-2026-62832CVE-2026-72971+6 CVEs

ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

Pwn2Own-demoed CVE-2026-62911 capture-replay authentication bypass in Microsoft Exchange allows unauthenticated remote attacks, CVSS 8.1.

ZDI-26-534 describes a capture-replay authentication bypass vulnerability in Microsoft Exchange, demonstrated at Pwn2Own, allowing remote attackers to bypass authentication without credentials. ZDI assigned a CVSS score of 8.1, and the flaw is tracked as CVE-2026-62911. Exchange servers are widely deployed enterprise mail infrastructure.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-62911

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers · 7d agoPhishing & fraud in the wild

Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.

GBHackers · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-85877CVE-2026-85875+27 CVEs

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers · 1d agoResearch in the wild1

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · Security · 11d agoPhishing & fraud