BlueHammer Windows Defender Zero-Day Led to Public Exploit Release and Active Attacks

A security researcher using the aliases Chaotic Eclipse and Nightmare-Eclipse publicly released working GitHub exploit code for BlueHammer, an unpatched Windows local privilege escalation flaw tied to Microsoft Defender’s signature update process. Independent testing by Will Dormann and others found the exploit worked, though reliability varied by platform and configuration. The attack abuses a TOCTOU race condition and path confusion in Defender’s update workflow, chaining components such as VSS, the Cloud Files API, and opportunistic locks to expose protected registry hives including SAM, SYSTEM, and SECURITY, extract NTLM password hashes, and potentially elevate a low-privileged user to NT AUTHORITY\SYSTEM.

Microsoft initially responded with a Defender detection signature for the published proof of concept, but researchers warned that signature-based blocking did not address the underlying logic flaw. The issue was later tracked as CVE-2026-33825 and patched by Microsoft on April 14, after which CISA ordered U.S. federal civilian agencies to remediate it within two weeks and added it to the Known Exploited Vulnerabilities catalog. Huntress reported the vulnerability was being used in zero-day intrusions involving hands-on-keyboard activity, and follow-on tooling such as BlueSAM showed how quickly the public disclosure was adapted for offensive use.