Defendnot Disarms Windows Defender by Pretending to Be a Friend

The post Defendnot Disarms Windows Defender by Pretending to Be a Friend appeared first on Android Headlines.

May 20, 2025 - 14:50

A newly developed, sneaky security program called Defendnot can trick and disable Windows Defender, which is built into Windows operating systems. This can happen even if users don’t install any genuine antivirus software, because the tool modifies the system to make Windows recognize it as a real antivirus program. Yeah, with this fake antivirus program, hackers can disable Windows Defender.

Hackers can now disable Windows Defender with Defendnot

This method works through an undocumented API that antivirus software uses to identify itself to the Windows Security Center (WSC). Normally, when an antivirus software identifies itself to the WSC, Microsoft Defender automatically shuts itself down to prevent conflicts.

Security researcher es3n1n developed the tool. Previously, the developer created a tool called no-defender for a similar purpose and used the code of a third-party antivirus software. The tech attracted great interest. After the company filed a complaint, GitHub removed it under the DMCA. This time, the developer created Defendnot by developing the entire infrastructure from scratch to avoid potential copyright issues.

Defendnot injects a specially prepared DLL file into the Taskmgr.exe (Task Manager) process. This process is signed by Microsoft and considered trustworthy, which helps the tool perform the fake antivirus registration. Thanks to this, the tool tricks Windows into thinking an antivirus is present and causes it to disable Defender. As a result, the system continues to work without any active protection.

es3n1n developed Defendnot for research purposes, but attackers can misuse it

Although cybersecurity researchers developed Defendnot for research purposes, we should not forget that malicious actors can misuse it. As we know, scammers try all sorts of methods to steal user data. Unfortunately, this seems to be a potential threat to users’ security systems and, therefore, their private data.

Well, Microsoft Defender now at least flags this sneaky tool called Defendnot as a Trojan, thanks to its machine learning algorithms, and quarantines it immediately.

The post Defendnot Disarms Windows Defender by Pretending to Be a Friend appeared first on Android Headlines.