While Windows Defender may appear fully operational to the casual observer, it can be covertly frozen on outdated threat signatures. The cybersecurity researcher Abdelhamid Naceri, operating under the pseudonym Nightmare Eclipse, recently released BigDiskBuster. This BigDiskBuster proof-of-concept tool is designed to stealthily sabotage Microsoft Defender updates while operating seamlessly in the background. Crucially, BigDiskBuster does not overtly disable the antivirus engine, nor does it abruptly terminate real-time protection protocols.

Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.

Abdelhamid Naceri, also known as Nightmare Eclipse, has publicly revealed his identity and released BigDiskBuster, a new proof-of-concept exploit that interferes with Windows Defender platform and signature updates. He says the tool works on all supported Windows versions, though it remains buggy, and he also recounted a bitter dispute with Microsoft...

could use some rewriting, but you get the concept read more about New Windows Defender zero-day blocks Microsoft antivirus updates

📰 Source : BleepingComputer — Date : 22 septembre 2026 Le chercheur en sécurité Abdelhamid Naceri (alias Nightmare Eclipse) a publié un nouveau proof-of-concept (PoC) zero-day nommé BigDiskBuster, ciblant Microsoft Defender.

Abres Seguridad de Windows, ves todo en verde y la pregunta llega sola: ¿con esto basta? Defender protege mejor de lo que mucha gente cree, y las pruebas independientes lo respaldan. Pero hay cosas que Seguridad de Windows no hace, y casi nunca es un fallo suyo: vienen apagadas, tu edición no las in

A new skeleton proof-of-concept demonstrates an arbitrary file read as SYSTEM on fully updated Windows systems, highlighting recurring flaws in Microsoft's patching process.

TL;DR A researcher published ShieldCrash, a Windows Defender 0day that bypasses Microsoft's patch for the ShieldBreak vulnerability (CVE-2026-6941). Both the vulnerability details and proof-of-concept exploit code are now public. The flaw reads arbitrary files as SYSTEM on all supported Windows versions. Why This Windows Defender 0day Matters The researcher, known as MSNightmare, released full details and working code on GitHub. Public exploit code lowers the bar for attackers.

At a glance Campaign Counterfeit software-download / fake installer campaign Threat actor Consistent with Silver Fox (Yinhu); moderate-confidence, not nation-state Targets China-based operations and Chinese-speaking users; many sectors Delivery vector Spoofed vendor download sites serving trojanized installers Key capabilities Persistence, SYSTEM privilege abuse, Defender tampering, C2 Source Microsoft Defender Experts TL;DR Attackers built high-fidelity clones of popular software sites. Victims download fake software installers that quietly deploy malware.

Paying no longer buys better basic malware protection

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft

Die Updates für Windows und Defender verursachen Probleme mit der Maus und führen zu falschen Warnungen vor dem Defender-Status.

Cet article présente la première rétro-ingénierie complète du driver BTR.sys (Windows Defender Boot-Time Removal), un composant légitime signé Microsoft embarqué dans MpEngine.dll. L'analyse a débuté lors d'une investigation de réponse à incident où le driver avait été initialement confondu avec un artefact malveillant en raison de ses caractéristiques inhabituelles.

Microsoft has resolved a bug that caused Windows Defender to crash after a recent security update, resulting in 0xc0000005 access violation errors on some affected systems.

This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC

Un error en el antivirus de Microsoft, Windows Defender, está generando demoras en la apertura de archivos MP3 al usar el reproductor multimedia VLC. El problema surge porque el servicio antimalware pone en cuarentena rutinariamente la caché de plugins de VLC, lo que provoca que el software tarde hasta 30 segundos en cargar los archivos. Jonathan Blow, diseñador de videojuegos, denunció públicamente este inconveniente, aunque VideoLAN responsabilizó a Microsoft como principal causante. La solución propuesta incluye reinstalar VLC o regenerar la caché de plugins. Este caso refleja un problema recurrente con Windows Defender al generar falsos positivos que afectan software legítimo de terceros. Aunque el reproductor VLC es ampliamente utilizado en múltiples plataformas, la compatibilidad con antivirus sigue siendo una área crítica para su funcionamiento optimo.

Microsoft has fixed a bug in Windows Defender that caused access violation errors and service crashes after a recent security update on some Windows 10 and Windows 11 systems. The issue triggered “Threat service has stopped. Restart it now” messages, and Microsoft says the correction is included in Defender signature update version 1.457.236.0 or later. #WindowsDefender #MicrosoftDefender

Ο ερευνητής «Nightmare Eclipse» δημοσίευσε κώδικα proof-of-concept που επιτρέπει την κλιμάκωση δικαιωμάτων σε επίπεδο SYSTEM στα Windows 11, παρακάμπτοντας τα προηγούμενα patches της Microsoft.