Week of March 2, 2026

A researcher demonstrated a technique to hijack Windows Defender's execution folder by creating a symbolic link with a higher version number in the Platform directory. After reboot, Defender runs from an attacker-controlled folder, enabling DLL sideloading or service disruption. This bypasses Defender's self-protection without requiring vulnerable drivers.

A new open-source tool named AMSIBypass has been released, implementing six different AMSI bypass techniques with randomized, multi-layer obfuscation to evade signature-based detection. The tool is designed for authorized security testing and can automatically test payloads until a working bypass is found, then inject it into a new PowerShell session.