A newly disclosed Windows vulnerability allows attackers to redirect Windows Defender security software to run malicious code instead of legitimate protections—completely disabling antivirus defense without installing traditional malware. The exploit creates symbolic links (filesystem shortcuts) in Windows Defender's system directories with fake version numbers higher than legitimate ones, so when Defender restarts, it launches attacker-controlled code with SYSTEM privileges instead. The attack was theoretically demonstrated in September 2025 and then actively exploited in the wild starting April 2026, when an anonymous researcher released working attack code after Microsoft delayed fixes. This represents a shift in how attackers operate: instead of writing malware to hide from security software, they're hijacking the security software itself using nothing more than built-in Windows commands.
Table of Contents
- How the symbolic link exploit works
- Who is affected and what's at stake
- Why detection is difficult
- A critical requirement: the attacker must have admin access
- How to defend and monitor
- Frequently Asked Questions
How the symbolic link exploit works
The attack exploits how Windows Defender selects which version of itself to run on restart. Defender stores platform files in `ProgramData\Microsoft\Windows Defender\Platform\` organized by version numbers. When the service starts, it runs whichever version folder has the highest number. An attacker with administrator access can create a symbolic link (a filesystem shortcut) with a version number higher than the legitimate one, pointing to a folder they control.
When Defender next restarts—either by schedule or by manual trigger—it automatically loads and executes the attacker's code instead, with full SYSTEM privileges. This requires only basic Windows commands (`mklink` and `rmdir`) that come standard on every Windows machine. No custom malware or specialized tools are needed, which helps attackers avoid signature detection and makes it harder to track who performed the attack. The entire attack chain leaves minimal forensic evidence because it uses standard Windows system operations.
Who is affected and what's at stake
The vulnerability affects Windows 10 (all versions), Windows 11 (all versions), and Windows Server 2016 through 2025. Since Windows Defender is enabled by default on virtually every installation, the potential scope is enormous—hundreds of millions of systems. The impact is severe: once Defender is hijacked, attackers running as SYSTEM can install ransomware, steal data, establish persistent access, or pivot to other systems on a network, all while the victim believes their antivirus is actively protecting them.
The attacks were particularly enabled when researchers released proof-of-concept exploits in April 2026 after Microsoft's slow patch response. Three specific zero-days—BlueHammer, RedSun, and UnDefend—were disclosed and actively exploited in the wild following that release. This public disclosure accelerated real-world attacks and underscored that the vulnerability moved from theoretical to weaponized.
Why detection is difficult
Traditional antivirus detection relies on signatures (patterns of known malicious code) or behavioral analysis of programs. This attack bypasses both because no malware is involved—only native Windows filesystem commands and registry modifications.
Security tools looking for malware traffic, suspicious processes, or code execution often see nothing unusual because the attacker is simply reorganizing folders and letting legitimate Defender code load from a malicious location. This fits a larger industry trend: CrowdStrike's 2025 Global Threat Report found that 79% of attacks involved no malware at all, shifting toward "living off the land" techniques that abuse legitimate system tools. Detection requires specific monitoring for symbolic link creation in critical system directories—a defense most organizations have not prioritized because it seems like a fringe technique.
A critical requirement: the attacker must have admin access
An important practical limit: the attack requires administrator-level local access to the target system. An attacker cannot execute this remotely or from a standard user account; they need to log in (or already be running code) with elevated privileges.
This means the vulnerability is most dangerous in environments where admins lose control of their systems, contractors or insider threats have elevated access, or where an attacker has already gained a foothold through a separate vulnerability or social engineering attack that grants admin rights. For organizations where admin access is tightly controlled and monitored, this shifts the risk profile. The vulnerability is serious but not universally exploitable—it's a secondary attack that amplifies damage once an attacker is already inside with high privileges.
How to defend and monitor
Organizations can implement several practical defenses. Enable Windows Tamper Protection to prevent modifications to Defender configuration and folders, monitor for symbolic link or junction creation in `ProgramData\Microsoft\Windows Defender\`, and enforce Windows Sandbox restrictions that limit what administrator sessions can do. Restricting who holds local administrative privileges is the most effective long-term control.
Detection requires logging and alerting on suspicious filesystem operations. Look for attempts to create symbolic links, changes to Defender platform folders, or unexpected version directories appearing in the platform path. Endpoint detection and response (EDR) tools that monitor process execution and file system integrity can catch unusual changes to system directories, though standard antivirus cannot detect the attack once it succeeds because the hijacked Defender process appears legitimate. The goal is catching the setup phase before the next restart triggers the payload execution.
Frequently Asked Questions
Does this attack work if I have Windows Defender set to auto-update?
Yes. Auto-update does not prevent the symbolic link attack because the attacker's link points to a higher version number, so Defender still selects it regardless of update frequency.
Can I detect if this has happened to my system?
Check the actual Defender platform folders at `C:\ProgramData\Microsoft\Windows Defender\Platform\`. If you see symbolic links or unexpected version folders, investigate immediately. Integrity monitoring tools or EDR solutions are more reliable than manual inspection.
Does Defender itself detect this attack if another instance is running?
No. Defender cannot detect an attack on itself while it is the target. A second antivirus can sometimes help, but once Defender is hijacked to run attacker code, full SYSTEM access is already achieved.