Reported by 2 outlets

Timeline

1. update from gbhackers.com

   Windows Defender Driver Abuse Enables Kernel-Level EDR and Antivirus Bypass

   gbhackers.com · 53d ago · August 21st, 2026

   Security researcher Jiří Vinopal has published a detailed analysis of BTR.sys, the Microsoft Defender Boot-Time Removal driver. His research reveals how this legitimate, Microsoft-signed component can be exploited to perform file and registry operations under attacker control from kernel mode. This study, titled “BTR Reforged,” does not rely on traditional memory-corruption vulnerabilities or the Bring […] The post Windows Defender Driver Abuse Enables Kernel-Level EDR and Antivirus Bypass appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Microsoft-Signed Defender Driver Weaponized to Disable EDR and Antivirus

   cyberpress.org · 53d ago · August 21st, 2026

   Microsoft Defender’s legitimate Boot-Time Removal driver, BTR.sys, can be repurposed to execute powerful kernel-level file and registry operations before many endpoint protections fully initialize. The technique, disclosed by Check Point Research, is not a traditional vulnerability involving memory corruption, privilege escalation, or a coding flaw. Instead, it shows how a trusted Microsoft-signed remediation component can be transformed into a Living-off-the-Land driver when an attacker reproduces its undocumented transaction protocol. Microsoft-Signed Defender Driver Weaponized BTR.sys is embedded in Microsoft Defender’s MpEngine.dll as the BOOTTIMETOOL resource. Defender deploys it when it must finish remediation after a reboot, such as deleting malware or other files that were locked while Windows was running. During legitimate operations, the driver may be written under a randomly generated name, installed as a temporary service, and configured through an Alternate Data Stream (ADS) called :changelist . Weaponizing Driver (Source: Checkpoint Research) This activity can look suspicious during incident response because it overlaps with techniques frequently associated with kernel-level malware loaders. However, BTR.sys is part of Defender’s normal remediation architecture and typically removes its files and service entries after completing queued operations. Check Point researchers reverse-engineered the driver’s proprietary transaction format and created a proof-of-concep

3. update from gbhackers.com

   Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

   gbhackers.com · 22d ago · September 21st, 2026

   A newly identified information-stealing campaign, tracked as Rapuncel, is exploiting a Microsoft-attested kernel driver to terminate up to 145 antivirus (AV) and endpoint detection and response (EDR) processes. This allows attackers to steal browser credentials, cryptocurrency wallet data, chat tokens, and Windows credentials. Researchers from the LastPass Threat Intelligence, Mitigation, and Escalation team, in collaboration […] The post New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .