GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban
GitLab suspended the account of Windows exploit researcher Nightmare-Eclipse on May 26, 2026, days after GitHub banned the researcher for publishing three Windows Defender zero-day tools.
The anonymous researcher known as Nightmare-Eclipse has been blocked from two major code-hosting platforms in less than a week, as their disruptive public zero-day campaign against Microsoft draws serious real-world consequences. GitLab moved to suspend the account of security researcher Nightmare-Eclipse on May 26, 2026, just days after GitHub, owned by Microsoft, terminated the researcher's account around May 23. The GitLab page had served as a rapid mirror of the six Windows Defender exploit tools previously hosted on GitHub, extending the researcher's reach even after the initial ban.
The researcher's campaign began on April 2, 2026, driven by open frustration over Microsoft's Security Response Center (MSRC) allegedly failing to act adequately on responsible disclosures. Over the following weeks, Nightmare-Eclipse released three headline-grabbing proof-of-concept (PoC) tools — BlueHammer, RedSun, and UnDefend — that directly target Windows Defender. BlueHammer (CVE-2026-33825) is a TOCTOU race condition (CVSS 7.8) in Defender's threat remediation engine enabling SYSTEM-level privilege escalation; it was patched in Microsoft's April 2026 Patch Tuesday update and added to CISA's Known Exploited Vulnerabilities catalog on April 22. RedSun abuses Defender's cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM and remains unpatched as of May 2026. UnDefend silently freezes Defender's signature update pipeline without triggering health alerts, degrading endpoint protection over time; it also remains unpatched.
Huntress Labs confirmed active exploitation of all three tools as early as April 10, 2026. Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation. Microsoft indirectly accused the researcher of violating coordinated vulnerability disclosure best practices, while patching some but not all of the reported flaws.
Nightmare-Eclipse, who also maintains a Blogspot blog, has now publicly announced a major disclosure event targeting July 14, 2026, warning that the date will be significant regardless of prior patches. The case intensifies the long-running debate over ethical disclosure timelines, platform accountability, and what researchers should do when vendors go silent.
Microsoft has publicly stated it will not pursue legal action against security researchers who publish vulnerability research, following backlash over a previous blog post that condemned uncoordinated zero-day disclosures and was perceived as threatening the pseudonymous researcher Nightmare Eclipse. The clarification, shared on social media, reaffirms Microsoft's support for ethical security research and acknowledges that some researcher interactions have fallen short, though it does not directly address Nightmare Eclipse's specific allegations of account deletion and withheld bounty payments. Meanwhile, Nightmare Eclipse announced a new Secure Boot vulnerability that fully bypasses BitLocker and may compromise confidential virtual machines, set for release in June.