Windows Defender Zero-Day Leak Fuels Active Exploitation Campaigns

A newly leaked zero-day targeting Microsoft Defender—dubbed “Nightmare-Eclipse” and leveraging tools/techniques like BlueHammer and RedSun—is being actively exploited in the wild; Huntress observed malicious binaries executed from user directories (e.g., Pictures, Downloads), reconnaissance commands (whoami/priv, cmdkey/list, net group), and Defender detections/quarantines, indicating real-world weaponization and probing of AV responses. Organizations are advised to monitor endpoint executions from user folders, review logs for suspicious enumeration activity, and ensure Defender signatures and advanced behavioral detections are enabled.