Loading story…
A publicly disclosed zero-day dubbed GreatXML can bypass BitLocker by abusing the Windows Recovery Environment (WinRE) state used during Microsoft Defender Offline Scan, allowing an attacker to obtain a SYSTEM shell and access an encrypted volume without a normal login. Reports say the attack works by placing a crafted unattend.xml file and a Recovery directory on the recovery partition, then rebooting the device into recovery mode, where Windows processes the malicious XML and exposes an unrestricted shell. The proof of concept was demonstrated on Windows 11 24H2 build 10.0.26100.1, and systems that have previously run Defender Offline Scan are described as especially exposed because the required recovery artifacts may already be present.
The exploit was published by security researcher Chaotic Eclipse, also known as Nightmare Eclipse or MSNightmare, and no official patch was available at the time of reporting. The attack appears to require brief physical access or another method of writing to the recovery partition, raising risks for stolen laptops, insider threats, and supply-chain tampering. Microsoft said it was assessing the issue and working on protections and patches, while criticizing the public release of proof-of-concept code as irresponsible amid a broader dispute with the researcher over vulnerability disclosure and bug bounty handling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The researcher publicly released proof-of-concept code for GreatXML on multiple code-hosting platforms, increasing the risk of exploitation. At the time of reporting, no official patch was available, and Microsoft said it was assessing impact and working on protections and fixes.
Security researcher Chaotic Eclipse, also known as Nightmare Eclipse / MSNightmare, publicly disclosed the GreatXML zero-day on June 10, 2026. The exploit abuses Windows Recovery Environment behavior and artifacts left by Microsoft Defender Offline Scan to bypass BitLocker and obtain a SYSTEM-level shell with physical access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcegithub.com
Open sourcetheregister.com
Open sourcedeadeclipse666.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
An anonymous researcher using the aliases **Nightmare-Eclipse** and **Chaotic Eclipse** publicly released details for two alleged Microsoft zero-days, **YellowKey** and **GreenPlasma**, adding to a string of earlier disclosures that included **BlueHammer**, **RedSun**, and **UnDefend**. YellowKey is described as a **BitLocker bypass** that requires physical access and a USB device, allowing an attacker to reboot into the Windows Recovery Environment (**WinRE**) and gain access to an encrypted drive; reporting said the technique was independently reproduced. Public materials claim the issue affects **Windows 11** and **Windows Server 2022/2025**, while **Windows 10** is not affected. GreenPlasma was disclosed as a **local privilege escalation** flaw that allegedly abuses `CTFMon` and Windows Object Manager section handling to obtain **SYSTEM** privileges, although reports said the released code still triggers a UAC prompt under default settings. Security experts warned that YellowKey could sharply raise the impact of laptop theft because BitLocker is often the final safeguard for stolen Windows devices; suggested mitigations include enabling a **BitLocker PIN** and locking firmware settings with a **BIOS password**, while no practical workaround for GreenPlasma was identified beyond a future vendor patch. Microsoft had not publicly responded to the two disclosures at the time of reporting, and prior proof-of-concept releases from the same researcher were reportedly later used in real-world attacks.
Jun 29, 2026
Microsoft has published **CVE-2026-50661**, a **Windows BitLocker** security feature bypass caused by **`CWE-693: Protection Mechanism Failure`**. The flaw allows an unauthorized attacker with **physical access** to bypass BitLocker protections on affected Windows systems, including multiple supported builds of **Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025**, before Microsoft’s listed fixed versions. Microsoft scored the issue **CVSS 6.1 (Medium)** and released vendor advisory and patch information through MSRC. If exploited, the weakness could let an attacker recover the **Volume Master Key**, decrypt the full physical volume, and access sensitive data such as user files, system configuration, and active session tokens. The same access could enable offline tampering, including modifying binaries, changing registry hives, or planting persistent malware such as **bootkits** or malicious drivers before the device is returned to service. Reported mitigations include applying Microsoft’s updates, requiring a **pre-boot PIN** for BitLocker, and disabling the Windows Recovery Environment with: ```bash reagentc /disable ```
Jul 15, 2026