Nightmare Eclipse Releases ShieldBreak PoC Targeting Microsoft Defender Cloud Filter API on Windows 11 and Server 2025

The exploit registers a temporary directory as a Cloud Sync provider, plants an EICAR test file, forces Defender to scan System32, then leverages Windows CLFS and cfapi callbacks to replace hydration data with a malicious phoneinfo.dll. Will Dormann's analysis shows wer.dll explicitly loads this non-existent DLL, executing attacker code under SYSTEM. The technique requires active Defender scanning, unlike the earlier RoguePlanet race condition that used virtual disks and NT native APIs.

Dormann and Kevin Beaumont both reject Nightmare Eclipse's RoguePlanet bypass claim. Beaumont notes ShieldBreak relies on user-mode callback hooks during cloud-hydration scans rather than filesystem races. This divergence highlights the researcher's pattern of rapid post-Patch Tuesday drops without precise technical mapping, creating noise that defenders must filter.

Procurement records and prior zero-days from the same actor show consistent targeting of Microsoft security tooling after official updates ship. The absence of independent technical attribution or Microsoft patch confirmation leaves the window open for in-the-wild use before September fixes. Detection queries published by Beaumont provide immediate telemetry hooks for EDR teams monitoring cfapi and scheduled task anomalies.

Operational impact centers on any environment running Defender on Windows 11 or Server 2025 where scheduled tasks execute without additional hardening. Next expected step is Microsoft acknowledgment within 14 days followed by an out-of-band or September Patch Tuesday remediation.