BitLocker, the built-in disk encryption tool of Windows, is rumored to have a major zero-day vulnerability. Security researchers recently disclosed an attack method called “YellowKey”, which proves that attackers can completely bypass BitLocker encryption protection and directly access the data on the hard drive by simply saving specific files to a regular USB flash drive without any recovery key or password. As soon as the news came out, businesses and individual users around the world who used BitLocker to protect confidential information were on high alert.
Microsoft BitLocker exposes serious zero-day vulnerability “YellowKey”
The attack process is very simple: copy the folder and hold down Ctrl to start the computer.
According to security researcher Chaotic Eclipse (also known as Nightmare Eclipse), the triggering process for YellowKey is quite simple. The attacker first needs to obtain write permissions to the “System Volume Information” directory of the target system, copy the specific “FsTx” folder to a USB flash drive, then boot the system into the Windows Recovery Environment (WinRE), and hold down the Ctrl key to boot. The system will jump directly to a high-privileged command prompt character interface.
Under this interface, the drive originally encrypted by BitLocker will be in an unlocked state, allowing attackers to freely read, modify or steal internal data. What is even more noteworthy is that the vulnerability file will be automatically deleted from the USB flash drive after execution, showing extremely high concealment, similar to the operating mechanism of a government-level “backdoor”.
Affected systems include Windows 11 and Server 2022/2025. Only Windows 10 is temporarily safe.
Preliminary tests have confirmed that the YellowKey vulnerability not only affects general desktop computers, but is also effective on operating systems such as Windows 11, Windows Server 2022, and Windows Server 2025, but Windows 10 does not seem to be affected at present.
It is worth noting that the malicious component of this vulnerability only exists in the Windows Repair Environment (WinRE) image file, and the same functionality cannot be found in ordinary Windows installations. This is one of the reasons why researchers suspect it is a “backdoor”: a component with exactly the same function has the ability to bypass BitLocker in WinRE, but it only exists in this repair environment. It is difficult to explain it as an “accident.”
Angry researcher’s long road to advocacy
The disclosure of the YellowKey vulnerability resulted from a feud between researchers and Microsoft’s security team. Chaotic Eclipse said that he had previously submitted multiple security reports to Microsoft, including the BlueHammer and RedSun vulnerabilities, but Microsoft not only failed to handle them properly, but also “added fuel to the fire”, ultimately forcing him to choose to make the vulnerabilities public.
The researcher publicly stated: “I could have made huge profits by selling this vulnerability, but no money can stop my determination to oppose Microsoft.” He also predicted that the next Patch Tuesday will have “bigger surprises.”
Prior to this, Chaotic Eclipse had released two zero-day vulnerabilities in April 2026, named BlueHammer (which turned the Microsoft Defender update process into a credential stealing tool) and RedSun, showing that the researcher was determined to fight Microsoft for a long time.
The vulnerability has been abused! Actual attack activity within 24 hours
The most worrying thing is that, according to Forbes, YellowKey and another GreenPlasma vulnerability (local privilege escalation by manipulating the CTFMon program) were confirmed to be exploited by actual attacks within 24 hours after they were made public. This means that attackers are already using these vulnerabilities in the wild before official patches are released.
No patch yet, experts call for strengthening hardware physical security
As of press time, Microsoft has not issued an official response to the two zero-day vulnerabilities, YellowKey and GreenPlasma. Before the official release of security patches, security experts recommend that users strengthen physical control of computer hardware, prevent unauthorized personnel from accessing USB ports or performing reboot operations, and restrict USB boot functions to minimize risks.
For high-risk environments (such as field equipment, shared workstations), it is recommended that enterprises immediately assess the degree of exposure and implement “compensatory control measures”, such as restricting USB boot access, enabling Secure Boot, and ensuring that WinRE images are regularly updated. If possible, consider using additional protection mechanisms other than full disk encryption to ensure that even if BitLocker is bypassed, there are still other lines of defense to protect data security.
Source: KOCPC Chinese