'MagicDot' Windows Weakness Allows Unprivileged Rootkit Activity

Or Yair (SafeBreach) disclosed 'MagicDot', a set of issues in Windows DOS-to-NT path conversion where automatic removal of trailing periods and spaces allows attackers to conceal files, impersonate legitimate paths, and obtain rootkit-like stealth without kernel access or admin rights; four related vulnerabilities were identified (notably an RCE via archive extraction and EoP via shadow-copy restore), several were patched by Microsoft, but the underlying conversion behavior remains and could enable further impactful exploitation — detection should focus on rogue trailing dots/spaces in file paths and developers should prefer NT paths.