Check Point Research Uncovers Windows Defender Blind Spot and AI Agent Vulnerabilities at Black Hat
Check Point Research presented two significant findings at Black Hat: a decade-old Windows Defender kernel driver that can be weaponized, and 12 CVEs in AI agent frameworks exploitable via familiar vulnerabilities.
Check Point Research researchers took center stage at Black Hat BTR Reforged, unveiling two critical security findings that highlight persistent vulnerabilities in foundational software and emerging AI technologies. The first presentation delved into a long-standing, unexamined kernel driver within Windows Defender, while the second exposed significant security flaws in popular AI agent frameworks.
Jiří Vinopal's talk, "The Driver Nobody Had Looked At," revealed a Windows Defender kernel driver, present for over a decade across multiple Windows versions, that operates with elevated privileges to clean up persistent malware. Despite its critical function and privileged access, the driver's internal workings, including its hardcoded encryption key, remained undocumented and unanalyzed until now. Vinopal successfully reverse-engineered the driver, demonstrating how it could be manipulated to execute arbitrary Ring 0 file and registry operations. This capability allows an attacker to potentially delete the entire Windows Defender stack, effectively disabling the system's primary security defenses from within.
Compounding the concern, this driver operates during the boot phase, a window where it can act before Defender's own protections are fully initialized. Since the driver performs functions as designed by Microsoft, there is no associated CVE and no immediate patch is expected. Vinopal released a tool called BTR_CLI and provided behavioral detection guidance, emphasizing that the defensive technology had been turned into an offensive capability.
Shifting focus to the rapidly evolving AI landscape, Shahar Tal and Yarden Porat presented "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks." Their research challenged the common framing of prompt injection, arguing that the most significant risks lie not just in model behavior but in how AI frameworks handle untrusted input through their internal components like serialization, caching, and file parsers. The researchers audited popular frameworks including LangChain, Google's ADK, Microsoft Agent Framework, and CrewAI.
Across these platforms, Tal and Porat identified 12 CVEs. A key takeaway was the minimal effort required from attackers; in many instances, malicious code is executed not through direct calls but by the framework itself processing poisoned data. For example, a compromised document loaded into an agent's memory could trigger the framework's save-and-reload mechanism, executing the embedded payload. The researchers stressed that many of these vulnerabilities are well-understood security issues, but their manifestation within AI agent frameworks requires a new approach to detection and remediation.
In a third presentation, Aleksandra "Hasherezade" Doniec addressed the challenges of analyzing atypical malware formats in "Breaking the Seal: Cracking Open Compiled V8 Bytecode Malware." Her work focused on JSCeal, a cryptocurrency-focused stealer that uses compiled V8 JavaScript bytecode, compressed with Brotli and run via a Node.js runtime, with the original JavaScript heavily obfuscated. Standard reverse-engineering tools struggle with this format, as the source JavaScript is typically unavailable.
Doniec developed a comprehensive deobfuscation pipeline utilizing the View8 disassembler and custom analysis passes to reconstruct readable code. This pipeline, combined with an LLM for naming functions, successfully recovered static analysis details from 20 JSCeal samples, revealing capabilities such as browser and cryptocurrency theft, session collection, keylogging, and the installation of an HTTPS interception proxy. The toolkit was released open source, enabling other researchers to analyze similar compiled bytecode malware.
Collectively, these presentations at Black Hat underscore critical security challenges: the potential for deeply embedded, long-standing system components to be weaponized, the re-emergence of classic vulnerabilities in new AI-driven architectures, and the need for advanced tooling to analyze novel malware obfuscation techniques. The findings highlight the ongoing cat-and-mouse game between defenders and attackers, with both leveraging sophisticated techniques and exploiting overlooked weaknesses.