GitHub Bans Researcher Who Published Windows Zero-Days

A security researcher known as Nightmare-Eclipse, who also goes by Chaotic Eclipse, has been banned from GitHub for reasons the company has not specified. The researcher has moved their projects to GitLab, while Microsoft has allegedly deleted the Microsoft account they used to report vulnerabilities.

A long-running dispute with Microsoft

The conflict dates back to early April, when Eclipse published a zero-day exploit called BlueHammer without prior warning. Since then the researcher has released several more Windows exploits and accused Microsoft's Security Response Center (MSRC) of ignoring reports and refusing to pay bug bounties.

In a blog post, Eclipse described the account ban as vindictive, saying they got zero pennies for their work — an apparent reference to the MSRC bounty programme, which pays between $30,000 and $100,000 for a qualifying zero-day and up to $250,000 for a Hyper-V flaw. The researcher says July 14 will bring a reckoning for the company, hinting at further exploit releases.

Six exploits, several already abused

Eclipse's published work includes BlueHammer and RedSun, both of which obtain SYSTEM-level access through Windows Defender, UnDefend, which takes Defender offline, GreenPlasma and MiniPlasma, which reach SYSTEM through other Windows components, and YellowKey, a BitLocker flaw that allows encrypted drives to be opened with little effort.

BlueHammer, RedSun and UnDefend have been confirmed as exploited in the wild. Because Eclipse published full or partial proof-of-concept code, experts note that anyone interested could use them.

Criticism and poor optics

Security researcher William Dormann of Tharros said MSRC used to be quite excellent to work with, but that Microsoft cut skilled staff to save money, leaving flowchart followers behind. He suggested the case may have been closed after the reporter refused to submit a video of the exploit, which he says is now an MSRC requirement.

Microsoft has not commented on the matter, so it remains unclear whether the dispute involves an uncooperative researcher or a company struggling to handle security reports. The GitHub ban, however, has drawn wide criticism: the code is public either way, so removing the account does little for security while drawing attention to the conflict.