Reported by 2 outlets

Timeline

1. original reporting

   Windows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel Drivers

   cyberpress.org · 36d ago · September 7th, 2026

   A new Windows attack technique called Bring Your Own Trusted Caller (BYOTC) shows how attackers can misuse trusted security applications to access powerful kernel drivers. The technique is related to Bring Your Own Vulnerable Driver (BYOVD), where attackers install a legitimate but flawed signed driver to gain kernel-level access . However, BYOTC does not always require a vulnerable driver. Instead, it targets a legitimate security driver that already includes sensitive features, such as terminating processes or opening protected handles. These functions are often necessary for antivirus, endpoint detection, anti-cheat, and system-inspection tools. To stop abuse, vendors usually allow only a trusted user-mode application to send sensitive commands to the driver. But this protection can fail if an attacker takes control of that trusted application. In a BYOTC attack, the attacker injects code into a signed security process or abuses the way a trusted process is created. The kernel driver sees a request from an approved client and allows it. However, the request is actually controlled by the attacker. Trusted Apps Kernel Hijack Researcher Xusheng Li found a BYOTC issue involving Malwarebytes’ mbamchameleon.sys driver. The driver included a legitimate feature that could terminate processes through the Windows ZwTerminateProcess function. Before using this capability, a process had to register as trusted. The driver checked whether the calling process was signed by Malwarebytes.

2. update from gbhackers.com

   BYOTC Attack Abuses Trusted Windows Clients to Access Privileged Kernel Driver Operations

   gbhackers.com · 36d ago · September 7th, 2026

   A newly documented Windows attack pattern, dubbed Bring Your Own Trusted Caller (BYOTC), shows how attackers can bypass driver-level authorization controls without exploiting a traditional memory-corruption flaw. Instead of attacking a privileged kernel driver directly, an adversary compromises or abuses the legitimate user-mode application that the driver already trusts. The technique expands on the well-known […] The post BYOTC Attack Abuses Trusted Windows Clients to Access Privileged Kernel Driver Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .