“Obviously by the time I drop this Crowdstrike would already have detections for it.” That is how a researcher known as Chaotic Eclipse introduced FalconFlank, a zero-day exploit aimed at CrowdStrike’s Falcon endpoint software.
For families and small businesses across the region who rely on security software to keep their devices safe, the story is a reminder that the guard itself can be a way in.
How it works
FalconFlank is a privilege escalation exploit. It targets Falcon’s feature that removes malicious macros from Microsoft Office files, a function that is part of the product’s remediation tools and runs with high privileges. The researcher says that behaviour can be abused to lift a low-privileged local user into a far more powerful position.
The proof of concept reportedly works on fully updated Windows 11 25H2 and Windows Server 2025 machines running Falcon with Phase 3 Optimal Protection, as long as the macro removal feature is switched on. Security firm Abstract adds that the technique depends on a DLL load, which the researcher says can be changed to dodge detection.
There is a catch in the announcement itself. CrowdStrike may already detect the published code, but blocking one sample is not the same as fixing the flaw behind it. Abstract noted there was no CVE and no confirmed vendor advisory when it wrote, so the claims remained the researcher’s own.
A string of anti-malware targets
This is not the first such release. Chaotic Eclipse, who also goes by INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, recently published HardBreacher against Kaspersky Endpoint Security. The researcher says it works on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504, though the code is unstable and may need repeated attempts. When it succeeds, it creates a DLL in System32 with full user permissions.
PrettyPrague followed, aimed at Avast Antivirus from Gen Digital. It abuses a flaw in Avast Sandbox to dump the Windows SAM database and obtain a SYSTEM-level shell. The researcher suspects AVG and Norton could be affected too.
Most earlier releases went after Microsoft products, among them the Undefend and RedSun Defender zero-days, and some were later exploited in the wild. The researcher often publishes after criticising how vendors handle bug reports, which has fuelled a debate over responsible disclosure.
CrowdStrike’s response
A CrowdStrike spokesperson said: “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.” The company pointed customers to the FalconFlank Tech Alert in its support portal.
Abstract advises defenders to watch for an OLE file written with a DLL extension, and for a bcrypt.dll appearing in the PowerShell v1.0 application directory, where none belongs on a clean system.
Sources
- Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank
- Chaotic Eclipse Releases CrowdStrike Falcon Zero-Day FalconFlank: Detection Guidance | Abstract
