NewsPublished 22 Sep 2026

Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity

Source SecurityWeek

Description

A security researcher known as Nightmare Eclipse, revealed to be Abdelhamid Naceri, a former Microsoft Germany employee, has released a new proof-of-concept exploit called BigDiskBuster targeting Microsoft Defender. The exploit prevents Windows Defender from completing platform and signature updates and reportedly works on all currently supported Windows versions. The code is still considered buggy and under development. Microsoft has not yet commented on this exploit. Naceri previously disclosed multiple Windows and Microsoft Defender exploits and has publicly shared details about his contentious departure from Microsoft.

Impact

If successfully exploited, BigDiskBuster could prevent Microsoft Defender from updating its platform and signature databases, potentially reducing the effectiveness of malware detection and protection on affected Windows systems. However, the exploit is currently a proof-of-concept with buggy code, and there is no evidence of active exploitation in the wild. The impact is limited to the disruption of Defender update processes, which could increase exposure to threats if left unmitigated.

Defensive guidance

Microsoft has not publicly responded or issued a fix for the BigDiskBuster exploit as of the latest information. Organizations should monitor official Microsoft communications for updates and apply any forthcoming patches promptly. No vendor advisory currently states that no action is required or that the issue is mitigated.

Summary

The researcher Abdelhamid Naceri, operating under the alias Nightmare Eclipse, has released a new proof-of-concept exploit named BigDiskBuster. This exploit disrupts Microsoft Defender's ability to complete platform and signature updates, potentially impairing its protective functions. The exploit reportedly affects all currently supported Windows versions, though the code is still unstable and requires further refinement. Naceri has a history of publishing Windows and Defender exploits and recently disclosed his identity and background, including his termination from Microsoft Germany.

References

securityweek.com/nightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 13:32 UTC

References

Community reviews