One researcher keeps delivering blows to Microsoft’s Windows security assumptions. And the latest strike landed just as the company pushed its June Patch Tuesday updates. The handle Nightmare Eclipse, also known as Chaotic Eclipse and MSNightmare, dropped GreatXML late on June 11. The tool claims to unlock BitLocker-protected drives through the Windows Recovery Environment.
But does it actually work? Independent tests so far say no. Short answer. The claim itself has sent security teams scrambling anyway. Because this isn’t the first time. It’s the latest in a string of public disclosures that started earlier this year and shows no signs of stopping.
The Register first reported the release. (The Register) According to the article the exploit requires copying an unattend.xml file and a Recovery directory to the root of the recovery partition. Then reboot into WinRE by holding Shift while clicking Restart. If done right a command shell with full access to the BitLocker volume appears. Or so the researcher says.
Nightmare Eclipse described the find as accidental. It took just four hours. The trigger condition ties to systems that have run a Microsoft Defender Offline scan at any point. That detail matters. Defender Offline scans serve as a common recommendation when malware infections appear. Organizations following best practices may have created the very condition the exploit needs.
Yet verification has proven tricky. Will Dormann a respected vulnerability researcher tested the PoC across multiple Windows 11 versions. He could not reproduce the claimed behavior. His results matter. They suggest the bypass may not deliver on its promise. At least not in the straightforward way advertised.
This marks the second BitLocker-related release from the same account. The first YellowKey appeared in May. It targeted the Windows Recovery Environment too. That one earned a CVE number CVE-2026-45585. Microsoft issued a mitigation and later included a fix in June updates. (The Hacker News) GreatXML followed hard on the heels of another disclosure called RoguePlanet a local privilege escalation affecting Microsoft Defender.
The pattern feels deliberate. Eight exploits in roughly ten weeks. Some received patches quickly. Others linger without CVEs or fixes. Barracuda’s analysis traced the campaign back to a researcher operating with a clear grudge against Microsoft. (Barracuda Blog) The account surfaced in March 2026. Since then it has targeted everything from BitLocker to Defender to core subsystems.
Frustration with silent patches and slow responses appears to drive the releases. In blog posts the researcher has questioned Microsoft’s practices directly. One post wondered aloud about silent fixes while hinting at more to come. Public PoCs land on GitHub under accounts that get renamed or moved when taken down. The latest lives at github.com/MSNightmare/GreatXML.
Security teams face a practical dilemma. Physical access remains a requirement for these BitLocker attacks. That limits the threat in many enterprise settings. Yet stolen laptops and devices left unattended represent real risks. Default TPM-only BitLocker configurations offer less protection than many assume once an attacker reaches the recovery environment.
Eclypsium broke down YellowKey in detail. The bypass abused built-in recovery behavior to grant an unlocked command shell. (Eclypsium) Systems without a pre-boot PIN proved especially vulnerable. Even with a PIN the researcher claimed a separate bypass existed but withheld the PoC to limit damage.
Ars Technica covered the initial YellowKey release. Multiple experts including Kevin Beaumont and Will Dormann confirmed it worked as advertised on default Windows 11 setups. (Ars Technica) The steps were simple. Place a custom folder on a USB drive. Boot into recovery. Watch the shell appear without needing the recovery key.
Help Net Security reported on Microsoft’s mitigation for the first flaw. The company advised disabling WinRE where possible or applying specific registry changes. (Help Net Security) Those steps reduce exposure but come with operational trade-offs. Recovery features exist for reasons after all.
GreatXML changes the conversation again. It doesn’t rely on the same WinRE quirks as YellowKey. Instead it manipulates XML files tied to past Defender Offline scans. The exact mechanism remains under scrutiny. If confirmed it would expand the attack surface to any machine that followed Microsoft’s malware remediation advice.
SOC Prime documented the original YellowKey disclosure and its ties to physical access scenarios. (SOC Prime) Their analysis highlighted how TPM-only setups leave data exposed once the recovery environment is reached. The new claim builds on that foundation but adds a novel trigger.
Microsoft has stayed largely silent on GreatXML so far. No official statement appeared in response to inquiries from The Register. No CVE assigned yet. No patch timeline shared. That silence echoes earlier stages of the campaign where disclosures forced reactive work.
The volume of releases creates its own pressure. Patch Tuesday in June addressed over 200 flaws including several from this researcher. Yet the newest drops arrived around the same time. The tempo challenges even a company of Microsoft’s size. Prioritizing which bug to fix first becomes harder when new ones appear weekly.
ThreatLocker examined the implications for organizations that rely on native Windows controls. Their tests showed application allowlisting can block some of the related exploits. (ThreatLocker) But BitLocker bypasses operate at a different layer. Once the volume unlocks data walks out the door regardless of later controls.
Recommendations have started to circulate. Require a pre-boot PIN on all protected devices. Disable WinRE in high-security environments. Monitor recovery partition changes. Use additional device encryption layers or hardware protections. None solve the root issue but they raise the bar.
Nightmare Eclipse shows no signs of slowing. Recent X posts track the rapid releases. One account noted four drops in recent weeks. Another highlighted the eight total tools since April. The researcher maintains blogs at deadeclipse666.blogspot.com where updates and hints appear.
Security professionals watch with a mix of concern and curiosity. The technical findings expose assumptions in Microsoft’s design. The delivery method raises questions about responsible disclosure. And the personal motivation adds an unpredictable human element to what should be a structured vulnerability management process.
YellowKey earned confirmation and a patch. GreatXML awaits similar scrutiny. Until more researchers reproduce the steps its impact stays uncertain. Dormann’s inability to trigger the shell suggests caution. Claims alone don’t rewrite security guidance. But they do force reexamination of long-held protections.
BitLocker was never meant to stop every determined physical attacker. It raises the cost and complexity. These exploits chip away at that margin. Each new technique makes the feature feel less like a guarantee and more like one control among many. Organizations that treat it as the final barrier may need to adjust their thinking.
The campaign continues. More releases seem likely before summer ends. Microsoft will patch what it can. Researchers will test the claims. Defenders will update playbooks. And the cycle repeats. This latest chapter in the Nightmare Eclipse saga underscores a simple truth. No encryption solution survives contact with a motivated finder of edge cases. Especially when that finder decides to share the results publicly.
WebProNews is an iEntry Publication