NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past

Microsoft's Defender antivirus software is reportedly facing issues after being targeted by a new zero-day exploit discovered and leaked by security researcher NightmareEclipse. Dubbed "BigDiskBuster," the tool prevents Windows Defender Antivirus from updating its platform and security intelligence, effectively trapping users in their current version.

NightmareEclipse, also known as Abdelhamid Naceri, explains that BigDiskBuster functions by creating hidden temporary files to consume available drive space, preventing the Defender update from completing. The researcher claims that BigDiskBuster can work on all supported versions of Windows, although the current proof-of-concept (PoC) is described as "buggy and in need of rewriting."

Microsoft Defender, while still operational, may struggle to identify newly detected malware due to the lack of updated threat definitions. The zero-day leak comes amidst a public conflict between NightmareEclipse and Microsoft over the company's vulnerability disclosure process. Microsoft has previously criticized NightmareEclipse for releasing zero-days without giving the company a chance to address them, and threatened legal action against individuals enabling cybercrime.

However, Microsoft later retracted these claims. Despite the ongoing dispute, there is no evidence that BigDiskBuster has been exploited in real-world attacks, and NightmareEclipse's claim of compatibility with all supported Windows versions remains unverified. As of now, Microsoft has not officially commented on the matter.