Windows Defender Vulnerability Lets Hackers Hijack and Disable Services Using Symbolic Links

A newly demonstrated attack technique has revealed a flaw in how Windows Defender manages its update and execution mechanism. By exploiting symbolic links, attackers can hijack Defender’s service folders, gain full control over its executables, and even disable the antivirus entirely.

Windows Defender stores its executables inside versioned folders under ProgramData\Microsoft\Windows Defender\Platform, and each update creates a new folder the service points to, a mechanism intended to protect critical files during version transitions.

Researchers found that it is possible to create new folders or symlinks inside the protected Platform directory, and by inserting a symlink folder with the highest version number, attackers trick Defender into executing from a location they control—for example, a link from C:\ProgramData\Microsoft\Windows Defender\Platform\5.18.25070.5-0 to C:\TMP\AV.

Once hijacked, Defender can be manipulated to read/write its binaries, overwrite or delete executables, or redirect the service to invalid paths, potentially disabling Windows Defender without third‑party tools. The disruption can also be achieved by deleting the symlink after reboot, causing the service to fail, and the technique relies only on built‑in commands such as mklink and rmdir. September 9, 2025.