Apr 10, 2026 · 5 min read
A Frustrated Researcher Dropped a Windows Zero Day on GitHub—Microsoft Still Has No Patch
The BlueHammer exploit chains five legitimate Windows features to escalate a standard user account to NT AUTHORITY\SYSTEM in under a minute. It remains unpatched and has no CVE.
What Happened
On April 3, 2026, a security researcher operating under the alias "Chaotic Eclipse" published a fully functional Windows privilege escalation exploit on GitHub. There was no coordinated disclosure, no assigned CVE, and no patch waiting in the wings.
The researcher, who also uses the handle "Nightmare Eclipse," had previously clashed with Microsoft's Security Response Center over how vulnerabilities are handled. "I was not bluffing Microsoft, and I'm doing it again," they wrote alongside the release. Their frustration centered on MSRC's process, including what they called an unnecessary requirement to submit video demonstrations of working exploits before reports would be triaged.
How BlueHammer Works
BlueHammer is a local privilege escalation that turns Microsoft Defender's own update mechanism against the operating system. The exploit combines a time of check to time of use (TOCTOU) race condition with a path confusion vulnerability, chaining five legitimate Windows features into a single escalation path.
The attack proceeds in stages. First, the exploit waits for a legitimate Defender signature update and downloads the update content directly from Microsoft's servers. When Defender begins processing the update file, the exploit places an opportunistic lock on it, pausing Defender at the exact moment it creates a Volume Shadow Copy snapshot.
That snapshot contains the Security Account Manager (SAM) database, which stores NTLM password hashes for every local account. The exploit reads the SYSTEM registry hive, reconstructs the 16 byte boot key, extracts the LSA secret key, and uses AES and DES routines to decrypt every stored password hash.
With those hashes in hand, the exploit forcefully changes a local Administrator password, logs in, duplicates a SYSTEM level security token, creates a malicious Windows Service running as NT AUTHORITY\SYSTEM, and then restores the original password hash to cover its tracks. The entire process takes less than 60 seconds.
Which Systems Are Affected
Researchers at Cyderes' Howler Cell team fixed bugs in the original proof of concept and successfully tested it against fully patched Windows 10 and Windows 11 systems. The exploit escalated a low privileged user shell to NT AUTHORITY\SYSTEM in under a minute.
Windows Server showed mixed results. Testing indicated the exploit sometimes reaches only elevated administrator rather than full SYSTEM access, and the proof of concept code contains bugs that prevent reliable exploitation across all environments. That inconsistency should not be mistaken for safety: ransomware operators and advanced persistent threat groups routinely clean up and weaponize public exploit code within days of release.
Microsoft's Response
Microsoft pushed a Defender signature update that detects the original proof of concept as Exploit:Win32/DfndrPEBluHmr.BB. That detection flags a specific compiled sample from the source code, not the underlying technique. Recompiling the code with minor changes defeats the signature entirely.
The company's public statement said it "has a customer commitment to investigate reported security issues and update impacted devices to protect customers as soon as possible." No CVE has been assigned. No patch timeline has been provided. No advisory has been published. The same researcher has since released two more Defender exploits, RedSun and UnDefend, both of which remain unpatched and are being actively exploited.
Why This Matters Beyond Windows
BlueHammer is a reminder that local privilege escalation vulnerabilities are not theoretical risks. Once an attacker has any foothold on a system, whether through a phishing email, a compromised browser extension, or a ClickFix social engineering attack, an unpatched LPE turns limited access into total control.
The dispute between the researcher and Microsoft also highlights a growing tension in vulnerability disclosure. Researchers increasingly feel that coordinated disclosure favors vendors who can delay patches indefinitely, while vendors argue that public drops endanger users. Both sides have a point, but the people left holding the risk are the billion plus Windows users who have no patch to install.
What You Can Do Now
Until Microsoft issues a proper fix, security teams should focus on detection and containment:
- Monitor for Volume Shadow Copy enumeration from user space processes
- Alert on unexpected Administrator password changes followed by immediate restoration
- Watch for low privileged accounts spawning Windows services
- Enforce least privilege aggressively, limiting interactions with Cloud Files APIs and VSS interfaces
- Track unexpected Cloud Files sync root registrations
The community has already published detection resources. A GitHub repository from the Howler Cell team includes seven Sigma rules and four YARA rules mapped to the MITRE ATT&CK framework.