Security researchers have uncovered a dangerous trend:
Attackers are abusing Microsoft Defender itself to gain SYSTEM access and weaken protections.
Using publicly available proof-of-concept (PoC) exploits, threat actors are now turning one of the most trusted security tools into a post-compromise weapon.
The three exploits you need to know
A researcher known as Nightmare-Eclipse released three exploits now being actively used:
🔹 BlueHammer
- Targets CVE-2026-33825
- Exploits a race condition in Defender’s update process
- Grants SYSTEM-level access
- ✔️ Patched by Microsoft (April 2026)
🔹 RedSun
- Targets Defender’s classification engine
- Works even on fully patched systems
- Uses simple triggers like EICAR test strings
- Grants SYSTEM-level access
🔹 UnDefend
- Used after gaining SYSTEM access
- Disrupts Defender updates silently
- Gradually reduces detection capability
- Avoids triggering alerts
Why this is serious
These exploits don’t just bypass Defender…
👉 They abuse its internal processes
Defender becomes part of the attack chain instead of the defense.
How attackers use them
Observed attacks show a simple but effective pattern:
- Gain initial access (often via compromised VPN accounts)
- Run basic reconnaissance
- Deploy PoC exploits from user directories
- Escalate privileges to SYSTEM
- Disable or weaken Defender silently
Stealth techniques observed
Attackers are using low-noise tactics:
- Storing payloads in:
- Downloads
- Pictures
- Renaming files to evade detection
- Using legitimate filenames
👉 Result: Lower detection rates and quieter attacks
The bigger issue
All three exploits highlight a deeper problem:
Over-trust in privileged workflows inside Defender
Key weaknesses include:
- Race conditions
- Lack of path validation
- Unsafe file handling
- Trust in internal processes
The real risk
These exploits require initial access — but once attackers get in:
👉 Escalation to SYSTEM becomes trivial
Even moderately skilled attackers can:
- Gain full control
- Disable protections
- Maintain persistence
How to protect your environment
1. Patch immediately
Install April 2026 updates to mitigate BlueHammer
2. Verify Defender version
Ensure:
- Antimalware Platform v4.18.26050.3011 or newer
⚠️ Don’t trust dashboards alone — they can be manipulated
3. Enforce MFA everywhere
Especially on:
- VPN
- Remote access systems
👉 Most attacks started with no MFA
4. Restrict execution paths
Block execution from:
- Downloads
- Pictures
- Temp folders
5. Add independent security layers
Use tools that:
- Don’t share trust boundaries with Defender
- Provide external validation
Final thought
This campaign proves a critical shift in modern cyber threats:
Attackers don’t just break security, they turn it against you!
