Windows Defender Driver Abuse Enables Kernel-Level EDR and Antivirus Bypass
Security researcher Jiří Vinopal has published a detailed analysis of BTR.sys, the Microsoft Defender Boot-Time Removal driver.
Microsoft
20 articles
Microsoft Entra ID RCE Flaw Lets Unauthorized Attackers Execute Code Remotely
Microsoft has disclosed a critical remote code execution vulnerability in Microsoft Entra ID, identified as CVE-2026-69836. This flaw could enable unauthoriz...
ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys
Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsof...
MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data
MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network pattern...
Microsoft Defender bug causing crashes resolved
The bug caused Windows Defender quick or full scans to fail, sometimes requiring the service to be restarted.
Using Microsoft Graph and Powershell - Risk Detection Commands, (Thu, Aug 20th)
Building on the last diary on Using MS Graph and Powershell, let&#;x26;#;39;s look at "Risky" logins.
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What...
Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure
A malicious Google Apps Script sidebar leads to payloads for both macOS and Windows.
Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses, (Thu, Aug 20th)
Microsoft Graph is a newer API that is meant to replace several others.&#;x26;#;xc2;&#;x26;#;xa0; OK, it&#;x26;#;39;s at version 2.
Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud
Threat actors are increasingly abusing Microsoft 365 identity sessions rather than deploying malware, as shown in a cloud-only business email compromise (BEC...
Hackers Impersonate Claude, ChatGPT and Copilot to Deliver Infostealers and Backdoors
Threat actors are increasingly abusing the popularity of generative AI brands to distribute malware, turning trusted names such as Claude, ChatGPT and Micros...
Microsoft says August Windows updates may cause gaming issues
Microsoft is investigating a potential issue with the August 2026 updates that may prevent some games from launching or cause them to crash on affected Windo...
Microsoft Defender Update Crashes Virus Scans on Windows PCs
Microsoft Defender has been aborting Quick, Full, and Offline virus scans on Windows systems following a series of Security Intelligence updates released on ...
Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026
Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runtime security with Microsoft...
Microsoft removes WMIC tool from Windows 11
WMIC, a legacy command-line utility for interacting with Windows Management Instrumentation (WMI), has been progressively phased out.
‘TWINLOOT’ Python implant abuses Microsoft services for stealthy C2
The implant ensures defenders only see legit Microsoft services rather than unknown external domains, making it more challenging to block attacks.
CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited
The U.S.
Windows 11 24H2 Home and Pro Support Ends in October 2026
Microsoft has issued a 60-day reminder that the Windows 11 version 24H2 Home and Pro editions will reach the end of updates on October 13, 2026. This date al...
Microsoft fixes known issue causing Windows Defender crashes
Microsoft has resolved a bug that caused Windows Defender to crash after a recent security update, resulting in 0xc0000005 access violation errors on some af...
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
The U.S.