MalwarePublished 16 Jun 2026

GhostTree Attack Abused Recursive Windows Junctions to Hide Malware

Source Bleeping Computer

windows

Description

GhostTree uses recursive NTFS junctions to generate vast numbers of valid Windows file paths. Varonis explains how the technique could cause Microsoft Defender folder scans to never complete, leaving malware undetected. [...]

Impact

Malware using GhostTree can evade detection by causing recursive folder scans to hang indefinitely, preventing antivirus and endpoint detection and response (EDR) tools from examining malicious files in affected directories. This results in undetected malware persistence on Windows systems. The technique requires only user-level permissions, making it accessible to attackers without elevated privileges. Although Microsoft patched the issue, systems without the patch remain vulnerable to scan evasion. The technique does not directly compromise system security boundaries but undermines malware detection capabilities.

Defensive guidance

Microsoft has patched the issue after being notified, so applying the official update resolves the vulnerability. Organizations should ensure Windows Defender and related security products are fully updated. Since the technique exploits legitimate NTFS junction features, monitoring file system activity for anomalous recursive junction creation and unusual directory structures is recommended as a complementary detection method. Endpoint scanning alone is insufficient to detect malware hidden via GhostTree. No additional immediate actions are required if patches are applied.

References

bleepingcomputer.com/news/security/ghosttree-attack-abused-recursive-windows-junctions-to-hide-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jun 2026, 14:30 UTC

References

Community reviews

Related threats