https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html
Microsoft Defender driver abuse enables pre-boot security deletionA report details how Microsoft Defender’s own driver can be weaponized to delete security software during boot, turning a trusted kernel component into an attack primitive before defensive tools fully initialize. The issue centers on abuse of a legitimate Microsoft Defender driver rather than a separate unsigned implant.Operationally