Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off

Microsoft reported on Friday that a bug in Windows is falsely informing users that their Microsoft Defender Antivirus software is turned off, even when it is functioning correctly. This issue persists even after users disable notification settings and can occur in any version of Windows or Windows Server with the latest Defender updates.

The bug has raised significant concerns among industry observers, as it could train users to ignore critical security alerts, making them more susceptible to ransomware attacks. Aman Mahapatra, chief strategy officer for Tribeca Softtech, warned that disabling endpoint protection is common in ransomware attacks and that ignoring the alert could have serious consequences.

He also predicted that attackers could leverage the bug for social engineering purposes. Lane Thames, team lead for cybersecurity R&D at Fortra, advised IT teams to communicate the issue clearly to users and verify the actual state of Defender rather than relying on the alert. Tom Kellermann, VP of AI security and threat research at TrendAI, stated that disabling security software is often a precursor to more systemic attacks.

Noah Kenney, principal consultant at Digital 520, recommended that CISOs and CIOs save evidence of the situation to potentially prove insurance claims, as insurers may not accept Microsoft's statement as proof that Defender was running.