Executive Summary
Since April 2026, an actor known as Chaotic Eclipse (or Nightmare Eclipse) has disclosed multiple zero-day exploits targeting Microsoft Windows internals. The primary threat, YellowKey (CVE-2026-45585), enables a BitLocker security feature bypass requiring only 60 seconds of physical access. By leveraging crafted Transactional NTFS (TxF) logs via a USB device, attackers can force the Windows Recovery Environment (WinRE) to launch a SYSTEM-level command shell without a password or recovery key.
The campaign also includes MiniPlasma, which exploits a race condition in the Cloud Files filter driver (cldflt.sys) to achieve local privilege escalation. These techniques are often chained, allowing an attacker to move from physical disk access to full OS control. While Microsoft has released mitigation guidance for YellowKey, the actor continues to release proof-of-concept (PoC) code, increasing the risk of widespread exploitation in environments relying on TPM-only BitLocker configurations.