Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans

Cybersecuritynews •Tushar Subhra Dutta • October 1, 2026

Hackers are abusing Microsoft Defender Antivirus exclusions to keep malicious files outside routine security scans. Rather than switching protection off completely, attackers can leave antivirus running while creating gaps around malware staging folders and selected file types. This is an established evasion technique, not a new malware family. It requires administrator privileges or higher, making […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit Microsoft Defender Antivirus Exclusions to Evade Detection Cyber adversaries are leveraging Microsoft Defender Antivirus (MDAV) exclusions to bypass security scans on malicious files. These exclusions allow users with administrative privileges to disable scans on specific files, folders, and processes, making it easier for attackers to hide malware. The Huntress team has identified that path and extension exclusions are particularly valuable for attackers, as they remove matching items from all types of scans. Microsoft supports four types of exclusions, but the misuse of these features poses a significant risk to organizations relying on MDAV for protection. Microsoft has not issued any patches or updates related to this issue, and the situation remains a concern for cybersecurity professionals. Organizations are advised to monitor exclusion settings closely and implement stricter controls on administrative privileges to mitigate this risk. 3 sources 55

Extracted Entities

Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)