> TritonInfoSec News
Home / Aug 22, 2026 / Story
0
#4 The Hacker News general August 21, 2026 at 15:52 UTC

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

By [email protected] (The Hacker News)

AI Summary

Check Point Research disclosed a technique abusing Microsoft Defender's legitimately signed boot-time driver BTR.sys (Boot Time Removal Tool) to perform arbitrary kernel-level file and registry deletions on Windows systems from Windows 7 through Windows 11 25H2. No external driver is required and no software vulnerability is exploited, meaning the technique is difficult to detect and block via conventional defenses.

Read full article → https://thehackernews.com/2026/08/microsoft-defend…

Relevance score: 88.0/100

# More from August 22

  1. 1
    Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution The Hacker News
  2. 2
    Microsoft warns of max severity Entra ID flaw exploited in attacks BleepingComputer
  3. 3
    GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure The Hacker News
  4. 5
    Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 The Hacker News
  5. 6
    CISA orders feds to patch actively exploited TrueConf Server flaws BleepingComputer
  6. 7
    Hundreds of leaked AWS keys give full control over corporate accounts BleepingComputer
  7. 8
    Rust Supply Chain Attack Linked to North Korean Hackers SecurityWeek
  8. 9
    Critical Zimbra RCE flaw now actively exploited in attacks BleepingComputer
  9. 10
    Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices The Hacker News