Security researcher Abdelhamid Naseri, operating under the alias Nightmare Eclipse, has published a new exploit called BigDiskBuster that targets Microsoft Defender. The tool blocks updates to both the Defender platform and its antivirus signatures, leaving Windows systems reliant on an already-installed and increasingly outdated threat database.
BigDiskBuster affects all supported versions of Windows but must remain running continuously in the background to maintain its effect. Naseri has stated that the current implementation contains bugs and requires additional development. The full source code has been made available on GitHub.
The new technique is similar to UnDefend, another tool released in April that also prevented Microsoft Defender from obtaining updates. The core risk is that the antivirus appears fully operational in the user interface while its signature base gradually becomes obsolete, increasing the chance of missing newer threats.
BigDiskBuster represents the latest in a series of public disclosures by Naseri targeting Windows components. Since April the researcher has released nearly a dozen proof-of-concept exploits affecting Microsoft Defender, BitLocker, and other system elements. These include ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and multiple Plasma variants.
Microsoft has patched some of the disclosed issues but has not yet released fixes for several others. The company has previously criticized the publication of working exploits without prior coordination, warning that such releases create unnecessary risk for users and may lead to legal action if real harm occurs. At the time of writing, Microsoft has not commented on BigDiskBuster or confirmed an available remediation.
Administrators are advised to monitor the actual success of Microsoft Defender signature updates rather than relying solely on the green status indicator in the interface.
