GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban
GitLab suspended the account of Windows exploit researcher Nightmare-Eclipse on May 26, 2026, days after GitHub banned the researcher for publishing three Windows Defender zero-day tools.
The anonymous researcher known as Nightmare-Eclipse has been blocked from two major code-hosting platforms in less than a week, as their disruptive public zero-day campaign against Microsoft draws serious real-world consequences. GitLab moved to suspend the account of security researcher Nightmare-Eclipse on May 26, 2026, just days after GitHub, owned by Microsoft, terminated the researcher's account around May 23. The GitLab page had served as a rapid mirror of the six Windows Defender exploit tools previously hosted on GitHub, extending the researcher's reach even after the initial ban.
The researcher's campaign began on April 2, 2026, driven by open frustration over Microsoft's Security Response Center (MSRC) allegedly failing to act adequately on responsible disclosures. Over the following weeks, Nightmare-Eclipse released three headline-grabbing proof-of-concept (PoC) tools — BlueHammer, RedSun, and UnDefend — that directly target Windows Defender. BlueHammer (CVE-2026-33825) is a TOCTOU race condition (CVSS 7.8) in Defender's threat remediation engine enabling SYSTEM-level privilege escalation; it was patched in Microsoft's April 2026 Patch Tuesday update and added to CISA's Known Exploited Vulnerabilities catalog on April 22. RedSun abuses Defender's cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM and remains unpatched as of May 2026. UnDefend silently freezes Defender's signature update pipeline without triggering health alerts, degrading endpoint protection over time; it also remains unpatched.
Huntress Labs confirmed active exploitation of all three tools as early as April 10, 2026. Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation. Microsoft indirectly accused the researcher of violating coordinated vulnerability disclosure best practices, while patching some but not all of the reported flaws.
Nightmare-Eclipse, who also maintains a Blogspot blog, has now publicly announced a major disclosure event targeting July 14, 2026, warning that the date will be significant regardless of prior patches. The case intensifies the long-running debate over ethical disclosure timelines, platform accountability, and what researchers should do when vendors go silent.