GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The anonymous researcher known as Nightmare-Eclipse has been blocked from two major code-hosting platforms in less than a week, as their disruptive public zero-day campaign against Microsoft draws serious real-world consequences.<\/p>\n
GitLab moved to suspend the account of security researcher Nightmare-Eclipse on May 26, 2026, just days after GitHub, owned by Microsoft, terminated the researcher\u2019s account around May 23.<\/p>\n
The GitLab page had served as a rapid mirror of the six Windows Defender exploit tools previously hosted on GitHub, extending the researcher\u2019s reach even after the initial ban.<\/p>\n
The researcher\u2019s campaign began on April 2, 2026, driven by open frustration over Microsoft\u2019s Security Response Center (MSRC) allegedly failing to act adequately on responsible disclosures.<\/p>\n
Over the following weeks, Nightmare-Eclipse released three headline-grabbing proof-of-concept (PoC) tools \u2014 BlueHammer, RedSun, and UnDefend that directly target Windows Defender.<\/p>\n
Huntress Labs confirmed active exploitation of all three tools as early as April 10, 2026. Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.<\/p>\n
Microsoft indirectly accused the researcher of violating coordinated vulnerability disclosure best practices, while patching some but not all of the reported flaws.<\/p>\n
Nightmare-Eclipse, who also maintains a Blogspot blog, has now publicly announced a major disclosure event targeting July 14, 2026, warning that the date will be significant regardless of prior patches.<\/p>\n
The case intensifies the long-running debate over ethical disclosure timelines, platform accountability, and what researchers should do when vendors go silent.<\/p>\n
Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.<\/strong><\/p>\n The post GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n