[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRyNsrTDEIHoMfUPuA2rEncROa4GBSM6ReZME5gf6lsA":3},{"article":4,"iocs":44,"watch_terms":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":28},"04fda975-62c4-4562-bb07-f94e0d9e8550","Exploits Turn Windows Defender into Attacker Tool","exploits-turn-windows-defender-into-attacker-tool-e060e1","Three proof-of-concept exploits are being used in active attacks against Microsoft's built-in security platform; two are unpatched.","Three proof-of-concept exploits are being actively leveraged in attacks to abuse Microsoft's Windows Defender security platform, turning it into a weapon for attackers. Two of the three exploits remain unpatched, leaving systems vulnerable to this abuse vector. The attacks demonstrate a novel technique of weaponizing built-in security tools against their intended purpose.","Three PoC exploits actively target Windows Defender; two remain unpatched.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fexploits-turn-windows-defender-attacker-tool","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt4525b1bf0b3427d5\u002F69e7b7f7df45795969187014\u002Fdefender_aileenchik_shutterstock.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-04-21T19:12:40+00:00","2026-04-21T22:00:16.580952+00:00",8,[18,21],{"name":19,"type":20},"Microsoft","vendor",{"name":22,"type":23},"Windows Defender","product","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":24,"icon":11,"name":26,"slug":27},"Zero-day","zero-day",[29,34,39],{"category":30},{"id":31,"icon":11,"name":32,"slug":33},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":35},{"id":36,"icon":11,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":11,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[45],{"type":38,"value":46,"context":47},"Windows Defender exploitation","Active exploitation of Windows Defender vulnerabilities in the wild",[19,22]]