Microsoft Defender

Attackers Abuse Legitimate Microsoft Defender Exclusions to Conceal Malware

Huntress researchers have detailed an evasion technique in which threat actors avoid disabling Microsoft Defender entirely. Instead, they create targeted exclusions for specific folders or file extensions, allowing malware to operate undetected while the protection status remains apparently active. These exclusions are configured through PowerShell commands, Windows Management Instrumentation, Group Policy, or direct registry modifications, all requiring administrator privileges after initial compromise. A registry key named HideExclusionsFromLocalAdmins can further conceal the list of exclusions from local administrators viewing the interface. The approach has been linked to campaigns involving GootKit in 2019, WhisperGate in 2022 that excluded the entire C: drive, and Muddled Libra in 2024. Defenders are advised to monitor registry changes directly, as this bypasses interface hiding, and to flag exclusions of entire drives or common directories such as temporary and downloads folders.

BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions

Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has released BigDiskBuster, a new exploit targeting Microsoft Defender that prevents the platform and antivirus signatures from receiving updates. The tool leaves Windows systems protected only by an outdated threat database while the interface continues to display normal status indicators. BigDiskBuster works across all currently supported Windows versions but requires continuous background execution. The researcher has published the source code on GitHub and acknowledged that the current implementation contains bugs requiring further refinement. The technique closely resembles the earlier UnDefend tool released in April, which similarly interfered with Defender update mechanisms. Naseri has disclosed nearly a dozen proof-of-concept exploits since April affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and Plasma variants. Microsoft has not yet issued a patch for BigDiskBuster and previously criticized uncoordinated public disclosures of working exploits.

Group-IB Uncovers HEAVYGRAM Multi-Stage Windows Spyware Controlled via Telegram Bot API

Researchers at Group-IB have identified 29 new samples of HEAVYGRAM, a sophisticated multi-stage Windows malware designed to target journalists, Iranian dissidents, and government critics. The campaign begins with social engineering lures that deliver archives containing fake Telegram, KeePass, or video editor files, along with WSF, HTA, and Persian-language screensaver payloads. Once executed, the malware uses PowerShell to fetch additional components, establishes persistence through Windows startup mechanisms, and adds its directories to Microsoft Defender exclusions. The core implant, written in Python and packed with PyInstaller, supports DLL side-loading and communicates exclusively through Telegram Bot API to receive commands, capture screenshots, enumerate processes, and exfiltrate data. A particularly damaging capability allows theft of Telegram Desktop session files, enabling account hijacking without password re-entry. Group-IB attributes the operation to the Handala Hack group, linked to the Void Manticore persona also tracked as Storm-0842 and Red Sandstorm, believed to operate on behalf of Iranian intelligence services.

Microsoft Defender Misclassifies Legitimate Google Search Links as Threats

Microsoft is investigating a false positive issue in Defender for Office 365 where legitimate Google search result links are incorrectly flagged as unsafe. Users attempting to open these links receive a warning stating the website may be insecure, and the problem persists even when copying and pasting URLs directly into browsers. The incident, tracked under advisory MO1465962, stems from erroneous classification by the Safe Links feature, which rewrites and rechecks URLs in email, Teams, and Microsoft 365 applications. The misclassification affects not only end users but also generates alerts for administrators in the Microsoft Defender Portal and Microsoft Sentinel SIEM platform. Safe Links is designed to protect against phishing by validating links at click time, but in this case it overreacted by blocking entire Google search URLs. Microsoft has not disclosed the number of impacted customers or affected regions and continues working on a fix for the erroneous classification.

Microsoft Defender Displays False 'Enable Virus Protection' Alerts on Windows Despite Active Real-Time Protection

Microsoft has confirmed a bug in Microsoft Defender that causes Windows to show persistent notifications urging users to enable virus protection even when the antivirus is already running with real-time protection active. The issue emerged after recent Defender updates and affects home users as well as enterprise environments running Windows 11 versions 23H2, 24H2, and 25H2, along with Windows 10 and Windows Server editions. Notifications appear at startup or during normal operation, ignore Do Not Disturb settings, and clicking them only opens the Windows Security app without resolving the alert. Microsoft is developing a fix to be released in a future Defender update but has not provided a timeline. Users are advised not to dismiss all such banners automatically, as similar messages could originate from malware, and should verify protection status through Windows Security or PowerShell commands. The problem stems from configuration errors introduced by the antivirus updates rather than specific Windows builds.

Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch

Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.

Microsoft Removes WMIC from Windows 11 After Years of Abuse as LOLBIN by Ransomware and Attackers

Microsoft has begun permanently removing the legacy WMIC command-line utility from Windows 11, starting with versions 24H2 and 25H2. The tool is no longer available in fresh installations, has been dropped as an optional component, and is absent from the latest beta builds. WMIC provided text-based access to Windows Management Instrumentation for querying hardware, processes, services, and security software, as well as performing administrative tasks. Although the underlying WMI technology remains untouched, Microsoft has deprecated the command shell due to its long-standing use as a LOLBIN in cyberattacks. Ransomware operators have leveraged WMIC to delete shadow copies and hinder recovery, while other attackers used it to enumerate and disable security tools or add exclusions in Microsoft Defender. Administrators are directed to migrate to PowerShell, COM API, .NET libraries, and modern scripting languages, which will require rewriting legacy automation scripts.

Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products

Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.

Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days

Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.