GitLab Suspends Nightmare-Eclipse After GitHub Ban

In less than a week, anonymous researcher Nightmare-Eclipse has been blocked from two major code-hosting platforms. This action follows their disruptive public zero-day campaign against Microsoft, which continues to generate serious real-world consequences.

GitLab moved to suspend the account of security researcher Nightmare-Eclipse on May 26, 2026, just days after GitHub, owned by Microsoft, terminated the researcher’s account around May 23.

The GitLab page had served as a rapid mirror of the six Windows Defender exploit tools previously hosted on GitHub, extending the researcher’s reach even after the initial ban.

The researcher’s campaign began on April 2, 2026, driven by open frustration over Microsoft’s Security Response Center (MSRC) allegedly failing to act adequately on responsible disclosures.

Over the following weeks, Nightmare-Eclipse released three headline-grabbing proof-of-concept (PoC) tools — BlueHammer, RedSun, and UnDefend that directly target Windows Defender.

• BlueHammer (CVE-2026-33825): A TOCTOU race condition (CVSS 7.8) in Defender’s threat remediation engine enabling SYSTEM-level privilege escalation; patched in Microsoft’s April 2026 Patch Tuesday update and added to CISA’s Known Exploited Vulnerabilities catalog on April 22.
• RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
• UnDefend: Silently freezes Defender’s signature update pipeline without triggering health alerts, degrading endpoint protection over time; also unpatched.

Huntress Labs confirmed active exploitation of all three tools as early as April 10, 2026. Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.

Microsoft indirectly accused the researcher of violating coordinated vulnerability disclosure best practices, while patching some but not all of the reported flaws.

Nightmare-Eclipse, who also maintains a Blogspot blog, has now publicly announced a major disclosure event targeting July 14, 2026, warning that the date will be significant regardless of prior patches.

The case intensifies the long-running debate over ethical disclosure timelines, platform accountability, and what researchers should do when vendors go silent.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.