🕵️ RESEARCH & DEEP DIVES
- Local uncensored AI model modifies Windows credential dumper to evade two EDR products
A locally hosted uncensored AI model modified a Windows LSASS credential dumper until it bypassed detection by two EDR products in a lab test.- Applies to Windows environments: the research targets LSASS memory dumping (MITRE ATT&CK T1003.001), used to harvest credentials for lateral movement after admin access.
- Project Black researcher Eddie Zhang generated the dumper with DeepSeek v4 Flash, but it triggered EDR detection and the model invoked a safety guardrail when asked for stealth.
- An uncensored community-modified Qwen 3.8 27B model running locally on two Nvidia RTX 4090s produced a build with zero detections on both lab EDR platforms.
- Qwen's modifications: altered process-spawning behavior, reduced LSASS access masks, randomized delays in minidump construction, changed output filename/path, and scrubbed embedded strings.
- Claude Opus 5, Opus 4.8, and Sonnet 5 refused the request; the experiment shows local guardrail-free models can iteratively rework offensive code offline.
- Scope is limited: the EDR vendors were unnamed and success against two lab products does not prove universal bypass capability.
🔓 CVEs & KEV
CVE-2026-85984 — cyberlord92 miniOrange OTP Login, Verification and SMS Notifications — CVSS 9.8 — miniOrange OTP Login, Verification and SMS Notifications through 5.5.5 - Unauthent...
CVE-2026-77203 — itthinx Groups – Memberships and Access Control — CVSS 8.8 — Groups through 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'group...