# Hackers Built an 'EDR Killer' That Disables 59 Security Tools — Using Legit Software

**URL:** <https://onehack.st/t/hackers-built-an-edr-killer-that-disables-59-security-tools-using-legit-software/317935>\
**Category:** News & Articles\
**Tags:** hacking\
**Created:** [February 4, 2026, 6:49pm UTC](https://onehack.st/t/hackers-built-an-edr-killer-that-disables-59-security-tools-using-legit-software/317935 "2026-02-04T18:49:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jenna](https://onehack.st/user_avatar/onehack.st/jenna/32/166322_2.png) [@Jenna](https://onehack.st/u/Jenna)\
**Post date:** [February 4, 2026, 6:49pm UTC](https://onehack.st/t/hackers-built-an-edr-killer-that-disables-59-security-tools-using-legit-software/317935/1 "2026-02-04T18:49:01Z")

</div>

# Hackers Built an ‘EDR Killer’ That Disables 59 Security Tools — Using Legit Software

> A malware tool kills 59 antivirus/EDR products using a trusted driver from 2006. Microsoft still hasn’t revoked the certificate.

* * *

### 🎁 What You Walk Away With

How attackers disable enterprise security using Microsoft’s own trust system. Plus 5 ways to profit from the EDR chaos.

* * *

### 🧠 Why This Matters

- 59 security products can be killed with one tool — including the expensive ones
- 💀 It uses a legit Microsoft-signed driver from 2006 that still works
- Companies are scrambling to patch — someone’s gotta help them

* * *

> **📰 What Actually Happened**
>
> **The tool:** Called “EDRKillShifter” — disguises itself as a firmware update, then uses a vulnerable but Microsoft-trusted driver to kill security software.
> 
> **How it works:** The driver from 2006 has kernel access. Attackers load it, then use it to terminate any security process — EDR, antivirus, whatever.
> 
> **Why it works:** Microsoft’s driver blocklist is opt-in. Most companies haven’t enabled it. The certificate is still valid after 18 years.
> 
> **The damage:** Ransomware crews are using this in active attacks. Once EDR is dead, they have free reign.

* * *

> **ಠ\_ಠ Cool. Security Software is Useless Now. What's MY Move?**
>
> 1. **The “Blocklist Enabler” Consultant**
> 
> 2. **The “EDR Health Check” Package**
> 
> 3. **The “Vulnerable Driver Scanner” Tool**
> 
> 4. **The “Incident Response” Retainer**
> 
> 5. **The “Security Awareness” Content**

![secure](https://media.giphy.com/media/l0MYt5jPR6QX5pnqM/giphy.gif)

* * *

### ⚡ Too Long, What’s the Move?

Hackers can kill 59 security tools using an 18-year-old Microsoft-signed driver. Offer “blocklist configuration” services to panicking IT departments — 30 minutes of work, easy $200.

* * *

_Source: [Ars Technica](https://arstechnica.com)_