The “RedSun” Zero-Day That Turns Microsoft Defender into a Malware Installer

A novel method to acquire total systemic hegemony over Windows has surfaced, and remarkably, it eschews complex kernel vulnerabilities in favor of exploiting the erratic behavior of the integrated antivirus suite.

A researcher operating under the pseudonym Chaotic Eclipse has disseminated a functional zero-day exploit targeting Microsoft Defender, an instrument christened RedSun. This marks the second time in a fortnight that the author has unveiled such tools, signaling an overt conflict with Microsoft.

The vulnerability facilitates a local elevation of privilege, empowering an adversary to ascend to SYSTEM rights—the zenith of authorization within the Windows environment. The exploit is operational across Windows 10, Windows 11, and Windows Server, persisting even on systems fortified with the April updates, provided Microsoft Defender remains active.

The crux of the issue lies in the antivirus’s handling of files demarcated with “cloud tags.” Under specific conditions, Defender autonomously overwrites a detected file in its original directory. By manipulating this mechanism, the exploit supplants critical system files to secure administrative sovereignty.

The efficacy of the assault has been verified by vulnerability analyst Will Dormann, who confirmed that the exploit successfully executes on fully remediated systems, including Windows Server 2019 and subsequent iterations.

The architectural logic of the attack is notably sophisticated. It leverages the cloud file interface, embeds the EICAR test string within a file, and subsequently orchestrates a race condition involving the Volume Shadow Copy service. Through path manipulation, the file is redirected to the system32 directory, where it overwrites the executable for the TieringEngineService. Consequently, the operating system inadvertently executes the malicious payload with SYSTEM-level privileges, granting the attacker absolute control.

While some security products currently identify the exploit due to the inclusion of the EICAR string, the author effortlessly bypassed detection by encrypting said string within the file. A comprehensive technical deconstruction of the vulnerability has been published by the specialist known as Kevlar.

A week prior, Chaotic Eclipse released another exploit for Microsoft Defender, identified as BlueHammer. That vulnerability was subsequently designated as CVE-2026-33825 and remediated by Microsoft during the April “Patch Tuesday” cycle.

The author maintains that the publication of both exploits is a direct consequence of a fractious relationship with the Microsoft Security Response Center (MSRC). He asserts that his interactions with the corporation resulted in profound personal grievances, prompting this unconventional form of protest. Microsoft has responded with measured restraint, stating that they rigorously investigate all vulnerability reports and prioritize swift remediation, while advocating for the industry standard of coordinated disclosure.