New EDRStartupHinder Tool blocks antivirus and EDR services at startup on Windows 11 25H2 Defender

Cybersecuritynews •Guru Baran • January 12, 2026

Security researcher TwoSevenOneT, known for EDR evasion tools like EDR-Freeze and EDR-Redir, unveiled EDRStartupHinder this week. The tool blocks antivirus and EDR services at startup by redirecting critical System32 DLLs via Windows Bindlink, demonstrated on Windows Defender in Windows 11 25H2. Antivirus and EDR services operate like standard Windows services but with enhanced protection from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup A new tool named EDRStartupHinder has been unveiled by security researcher TwoSevenOneT. This tool is designed to block antivirus and EDR services at startup on Windows 11 25H2 by redirecting critical System32 DLLs, specifically demonstrated on Windows Defender. The tool is part of a series of EDR evasion tools developed by the researcher. 3 sources 24

Extracted Entities

New EDRStartupHinder Tool blocks antivirus and EDR services at startup on Windows 11 25H2 Defender

The full story

Extracted Entities

Attack Types (1)

Platforms (2)

Tools (3)