"The most durable zero-days don't always need a bug. [BlueHammer] turns Microsoft Defender's own update workflow into a credential theft mechanism by chaining five legitimate Windows features in a sequence their designers never intended." [1] About this post: I'm the author and maintainer of bluehammer-analysis, the repository this entry documents. It is an ethics-first archival study of the Blue