Zero-Day Alert: The “Red Sun” Vulnerability Turning Microsoft Defender into a Hacker’s Tool

The report describes three unpatched vulnerabilities in Microsoft Defender—Red Sun, BlueHammer, and UnDefend—that allow an attacker to overwrite system files and achieve local privilege escalation through a race condition involving Defender update workflow, Volume Shadow Copy, Windows Cloud File APIs, and opportunistic locking; proof-of-concept code is public and researchers warn of active weaponization in the wild.