Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Home / Tech / Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

August 21, 2026 dirk 0 Comments 3 tags

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.sys (Boot Time Removal Tool), is a

Source: The Hacker News

Explore More

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first

Ember, a native iOS Hacker News reader I built around accessibility

Ember, a native iOS Hacker News reader I built around accessibility Source: Hacker News

OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates

OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning