Week of December 1, 2025

A new proof-of-concept tool named CLR-Unhook removes security product hooks from the nLoadImage function in clr.dll, restoring the original CLR behavior. This allows in-memory .NET assembly loads via Assembly.Load(byte[]) to execute without EDR inspection or scanning, bypassing products like CrowdStrike, Bitdefender, and SentinelOne.

A researcher developed a proof-of-concept malware loader that dynamically analyzes its environment to evade Windows Defender detection and establish command and control. The loader uses techniques like process injection and API unhooking to bypass real-time protection. This demonstrates a method to circumvent endpoint security without exploiting a specific CVE.

A proof-of-concept demonstrates bypassing Windows Defender real-time protection by embedding a Meterpreter reverse shell payload inside a JPG file. The payload executes undetected, establishing a reverse shell to a Kali Linux attacker. The technique relies on steganography to hide the malicious code from static and dynamic analysis.