Microsoft Defender Zero-Day Vulnerability Actively Exploited

A recently disclosed Microsoft Defender vulnerability has been actively exploited as a zero-day, allowing attackers to access the Security Account Manager (SAM) database, extract NTLM hashes, and escalate privileges to System level. The flaw is associated with threat activity tracked under names such as BlueHammer, RedSun, and UnDefend. No specific CVE identifier, exploitation timeline, or affected software versions were provided in the report. The impact includes unauthorized privilege escalation and potential credential theft on compromised systems. No mitigation steps or patches were detailed in the available content.