In 2026, a security researcher known as Nightmare Eclipse released several proof-of-concept exploits targeting Microsoft products and third-party security software. The researcher, who identified himself as Abdelhamid Naceri, stated that his actions were motivated by a conflict with his former employer, Microsoft.
The HardBreacher exploit, released on August 29, 2026, targets Kaspersky Endpoint Security 14.0.0.504 on Windows 11 25H2. It uses NTFS hardlinks and symbolic link redirection to load an unsigned DLL into the avpui.exe process. This allows the attacker to hide notification windows and terminate the UI process, effectively disabling user alerts.
The PrettyPrague exploit, published on August 30, 2026, targets Avast Antivirus. It leverages the software's sandbox virtualization mechanism to access the SAM database, extract NTLM hashes, and temporarily change user passwords. This allows the attacker to escalate privileges to the SYSTEM level.
Gen Digital released patches for the Avast vulnerabilities on September 4, 2026, in versions 26.7.11086 and 26.8.11125. Kaspersky addressed the HardBreacher issue through an antivirus database update on August 30, 2026. Security experts recommend focusing on behavioral anomalies rather than static file signatures for detection.
