Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild

A security researcher published PoC exploits (BlueHammer, RedSun, UnDefend) targeting Microsoft Defender to escalate privileges and prevent or disable signature updates; Microsoft patched BlueHammer as CVE-2026-33825 on April 14, while RedSun and UnDefend PoCs were posted later and confirmed effective. Huntress reported active in-the-wild use, where attackers dropped exploit files into Pictures/Downloads, mapped user privileges, retrieved stored credentials, and enumerated Active Directory, prompting calls for an out-of-band Microsoft fix.