ShieldBreak Turns Windows Defender Into a Way to SYSTEM on Fully Patched Windows 11

Nightmare Eclipse published his tenth Windows attack and it lifts a normal account to SYSTEM. It only works on machines with Defender switched on. It is a full bypass of the patch Microsoft shipped in July.

I have been following this researcher since April, through BlueHammer, RedSun, UnDefend, YellowKey, MiniPlasma, RoguePlanet, GreatXML and LegacyHive. Eight articles. After the last one it went quiet on my side while it kept moving on his, so I went back to find out how he is doing now, what he has released since July, and where this fight actually stands.

Ten working attacks on Windows in under five months, from one person.

Microsoft did answer this time. Three days after he published it, the company gave the flaw a number, CVE-2026-69414, and says it is working on a security update.

He published ShieldBreak about two and a half hours after Microsoft finished its August Patch Tuesday disclosures, the same timing he has used since April. It attacks Windows Defender, the security software built into Windows. An ordinary user account goes up to SYSTEM, the highest level of access a Windows machine has. From there nothing on the machine is closed to you.

The attacker is already signed in when this starts. Malware that landed earlier, or an account that was stolen. This is the step that takes them from a plain user to full control of the machine, the same category as LegacyHive in July.

It has been tested on Windows 11 25H2, including the Canary channel that runs ahead of the builds most of us are on, and on Windows Server 2025. He puts the success rate at 100 percent. That is unusual for this kind of flaw, because his previous one worked on some machines and failed on others.

One thing in the coverage is wrong. Several outlets wrote that it runs on Windows 10. His own repository says the opposite: Windows 10 and the matching server editions are not supported by this proof of concept, although he says they are vulnerable to the underlying flaw.

Here is how it works.

Microsoft patched his previous Defender attack, RoguePlanet, in July and gave it the identifier CVE-2026-50656. That one was a timing flaw in the way Defender quarantines and cleans a file. It checks a path, then acts on it, and in the gap between those two steps an attacker swaps out what Defender is about to touch. The July fix closed the route he used to do the swapping.

ShieldBreak runs the same kind of race. It is not a different family of bug. It is the same cleanup, entered through a different door. Where the old version redirected through the file system, this one moves the redirection down into the NT Object Manager, the naming layer that sits underneath the drive letters you can see.

A security firm rebuilt the chain from start to finish on a fully patched machine a week after release and confirmed it does what he says. It runs in eight to twelve seconds. It takes no arguments and no setup, you double-click the file.

What comes out the other end is a library sitting in System32 under a name Windows will load, and a shell running as SYSTEM.

phoneinfo.dll does not exist on Windows. Not on any version. Windows Error Reporting goes looking for it, does not find it, and carries on. He puts a file there under that name and waits for something trusted to come looking. Nothing is replaced and nothing is overwritten.

And in the logs, the process that wrote the library into System32 is MsMpEng.exe. That is Defender. Your own security software is recorded as the thing that put the attacker’s file on your machine, because that is exactly what happened.

Defender has to be enabled for any of this to work. If Defender is not running, the scan the chain hangs on never happens. The component doing the privileged work is the security software, and the machines that are exposed are the ones running the protection they were told to run. That is not an argument for switching it off, and switching it off would cost you far more than it buys. It is a reminder that software running as SYSTEM is worth attacking precisely because it runs as SYSTEM, and that includes the software guarding the machine.

It is also the answer to why this keeps happening to the same product. Defender’s engine runs as SYSTEM across several separate jobs: scanning, quarantine, cloud hydration, cleanup. Each one is its own road to the same privileged place. Microsoft closed the road RoguePlanet used, and he took the next one over. Closing one does not retire the others.

Under acknowledgements, that CVE record credits Anonymous. Not the name he has been publishing under all year. And that is not new. Credit going somewhere else is one of the things he says started this in April. When Microsoft shipped the BlueHammer fix that month, it named two other researchers instead of him. He says the restrictions that followed mean he can no longer report bugs to other vendors either, and that Microsoft does not answer him at all.

The May blog post is still there too. When this fight became public, Microsoft published a piece saying that releasing attack code for unpatched flaws cannot be justified, and pointed at its Digital Crimes Unit. Many researchers read that as a threat of prosecution. After heavy criticism the company softened its position on June 1 and said it had no intention of going after people doing security research, which I covered at the time. What I had not checked until now is that the softening only ever appeared as a social media post. The original piece is still online with the same language, three months later.

The other side of it belongs in the same breath. Three of his earlier releases were seen in live intrusions against companies that had nothing to do with his fight: BlueHammer, RedSun and UnDefend. All three ended up on the US catalogue of flaws known to be exploited in the wild. For ShieldBreak, nearly two weeks on, no such reporting exists.

One thing on that is not settled. A vendor analysis the day after release said Microsoft appeared to have pushed Defender signatures that catch this exploit in its published form, in careful wording that left open whether a modified version would still get through. A week later another firm rebuilt the chain on a fully patched machine and it ran.

A fix is coming, so the advice is short. Watch CVE-2026-69414 and install the update the day it lands. Which of the earlier ones have been patched and which are still open, I keep updated on my own site.

That is the technical half. The other half is what he wrote three days later.

CVE-2010-2743 is the Windows flaw that Stuxnet used. The kernel component that draws what you see on screen also loaded keyboard layout files, and it could be made to load one it should never have trusted. Windows Vista dealt with that by locking the door: a keyboard layout file is only accepted if it sits in a trusted system folder. In 2012 Microsoft carried the same lock back to Windows XP and Server 2003 with MS12-034, and said at the time that this made the Stuxnet flaw a non-issue.

What the lock does not account for is alternate data streams. That is a feature of the NTFS file system where a file carries extra hidden content attached to its name after a colon. A path like this:

1

C:\Windows\System32\Tasks:t.kbd

reads to the kernel as sitting inside a trusted folder, and a standard user is allowed to create one of those in the Tasks directory. So an untrusted keyboard file can reach the kernel after all.

One thing stood in the way. A file created that way ends up owned by SYSTEM and inherits its permissions from the folder. You can write to it, but you cannot read it back, and reading it is exactly what the loading function needs. He says he worked out why. It comes down to a bug in NTFS itself, and he found a way to get the read access back.

He has a working proof of concept, and he is not releasing it. That is the first time in this series that he has held something back. His reasons, in his own framing, are two. Publishing it would bring him more trouble than he can carry, and the reading trick would be patched while he still expects to need it.

One thing to keep straight. There is no code with this one, so it is his word. But he names the exact function and the exact mitigation, and everything he has described so far worked.

Who he is, we still do not know, and I want to be careful here because the reporting has been sloppier than the facts. The furthest the trail runs is a chain published at the end of May. He claims two older CVEs as his own on an account going back to 2020. Microsoft’s own acknowledgements credit those two flaws to one named researcher, and that researcher’s professional profile lists Germany and a full-time role at Microsoft from September 2022 to June 2025. No name was published, and two months later the security press still describes him as suspected of being a former Microsoft engineer, based on how well he knows the internals.

So the trail runs through Microsoft’s own credit page and stops at a profile. A strong lead, not a confirmation, and I am not going to write it as one.

I have said before that bug hunters carry the risk, do the hard part, hand the result over, and are treated as an afterthought. I have watched it happen to people I know and it has happened to me, at more than one company and not only at Microsoft. Whatever you think about how this researcher chose to fight, that pattern is older and bigger than him, and it is why so many people who disagree with his methods still recognise the thing he is angry about. He is not standing there on his own either, whether he knows it or not. There are people who would help if he asked, and my inbox is always open.

You can walk the same climb on your own lab machine: a low-privilege account, an enumeration pass, and the settings that hand out SYSTEM. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Nightmare Eclipse | LevelBlue SpiderLabs