Day 2 at Black Hat: Check Point Research Takes the Stage
Check Point Research presented three talks at Black Hat covering: (1) a Windows Defender kernel driver (BTR) with a hardcoded encryption key across all signed builds spanning Windows 7–11 25H2, enabling arbitrary Ring 0 operations with no CVE or patch; (2) twelve CVEs across four major AI agent frameworks where poisoned content triggers exploitation through framework serialization and caching internals without direct tool invocation; and (3) a deobfuscation pipeline for JSCeal, a V8 bytecode-compiled cryptocurrency stealer whose payloads include credential theft, keylogging, and HTTPS interception.
Detection / Hunteropenrouter
What Happened
Researchers at Check Point presented three findings at the Black Hat security conference. First, they discovered that a core part of Windows Defender — a built-in tool meant to clean up stubborn malware — has used the same secret encryption key for over fifteen years across every version of Windows. This means anyone who figures out how the driver communicates could send it their own instructions to delete security software or modify critical system files, and Microsoft has no plans to fix it because the driver is working as designed. Second, they found twelve security flaws in popular AI assistant building kits (LangChain, Google ADK, Microsoft Agent Framework, and CrewAI) where simply feeding poisoned documents into an AI agent's memory could trigger harmful actions automatically — no direct hacking required. Third, they built a toolkit to analyze a type of cryptocurrency-stealing malware (called JSCeal) that hides its code in a format most security tools cannot read, recovering evidence of password theft, keystroke logging, and even a technique to intercept secure web traffic. Organizations using Windows, any of the affected AI frameworks, or systems that might be exposed to cryptocurrency malware should review the released detection guidance and tools.
Key Takeaways
- A Windows Defender kernel driver (BTR) uses a hardcoded encryption key across all builds from Windows 7 through Windows 11 25H2, allowing anyone who reverse-engineers the protocol to issue arbitrary Ring 0 file and registry operations — including deleting the entire Defender stack. No CVE exists and no patch is expected because the driver is functioning as designed.
- Twelve CVEs were discovered across four major AI agent frameworks (LangChain, Google ADK, Microsoft Agent Framework, CrewAI). Several exploits require no direct tool invocation — poisoned content in agent memory triggers payloads via the framework's own save/reload serialization behavior.
- JSCeal, a cryptocurrency stealer tracked since early 2025, delivers payloads as compiled V8 JavaScript bytecode wrapped in Brotli compression via a bundled Node.js runtime, making standard reverse engineering tools ineffective. A full deobfuscation pipeline using View8 was released open source.
- JSCeal payloads recovered statically revealed browser credential theft, cryptocurrency wallet theft, Telegram session harvesting, keylogging, screenshot capture, and a local HTTPS interception proxy that installs an attacker-controlled certificate.
- BTR_CLI and the V8 bytecode deobfuscation toolkit were both released as open source, along with behavior-based detection guidance for the BTR driver.
Affected Systems
- Windows 7 through Windows 11 25H2 (BTR kernel driver present on all builds)
- LangChain AI agent framework
- Google Agent Development Kit (ADK)
- Microsoft Agent Framework
- CrewAI agent framework
- Systems running Node.js applications processing untrusted content (JSCeal target)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access (BTR): Attacker gains sufficient privileges to write encrypted instruction files to disk that the BTR kernel driver reads during boot or runtime
- Execution (BTR): Driver decrypts instructions using the hardcoded key and executes arbitrary Ring 0 file and registry operations, including deletion of the Defender stack
- Initial Access (AI Frameworks): Attacker delivers poisoned content (e.g., documents) into an AI agent's memory or context
- Execution (AI Frameworks): Framework's own save/reload serialization behavior processes the poisoned content, triggering the payload without direct tool invocation
- Initial Access (JSCeal): Victim executes a bundled Node.js application containing compiled V8 bytecode wrapped in Brotli compression
- Collection & Exfiltration (JSCeal): Payload performs browser credential theft, crypto wallet theft, Telegram session harvesting, keylogging, screenshot capture, and installs a local HTTPS interception proxy with an attacker-controlled certificate
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: BTR_CLI (open-source tool), V8 bytecode deobfuscation toolkit (open-source)
The article mentions behavior-based detection guidance for the BTR driver released alongside the BTR_CLI tool, and a deobfuscation pipeline for V8 bytecode malware. No specific YARA, Sigma, Snort/Suricata, or query rules are reproduced in the article. The open-source tools and detection guidance are referenced as released at the Black Hat talks.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The BTR driver operates in Ring 0 and executes during a boot-phase window before Defender's own protection activates, potentially below EDR visibility. JSCeal's V8 bytecode format may not be flagged by signature-based EDR. However, behavioral detection of the driver's file/registry operations and JSCeal's post-exploitation activities (keylogging, screenshot capture, certificate installation) should be visible to EDR if it monitors kernel-level file operations and process behavior. |
| Network Visibility | Medium | JSCeal's HTTPS interception proxy and potential C2 communications could be visible at the network level. AI agent framework exploitation may generate unusual outbound requests from application servers. The BTR driver activity is entirely local with no network component. |
| Detection Difficulty | Hard | The BTR driver executes legitimate kernel operations as designed, making behavioral detection challenging without understanding the instruction protocol. JSCeal's compiled V8 bytecode format evades standard static analysis tools. AI agent framework exploitation occurs through legitimate framework serialization paths, blending into normal application behavior. All three require custom detection logic rather than signature-based approaches. |
Required Log Sources
- Windows kernel file and registry operation logs (Event Tracing for Windows)
- EDR process creation and file modification telemetry
- Certificate store modification logs
- Application logs from AI agent framework servers
- Network proxy/IDS logs for HTTPS interception and C2 detection
- Node.js process execution logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for kernel driver activity that performs bulk file deletions or registry modifications targeting security product directories, particularly during early boot phases before EDR services fully initialize. | Windows kernel file/registry operation ETW traces, EDR early-boot telemetry, Windows Event Log System channel | Defense Evasion | Medium — legitimate security product updates or system cleanup tools may perform similar bulk operations during boot. |
| Consider hunting for AI agent framework processes that execute file read/write operations or network calls triggered by content deserialization events rather than explicit user or tool-initiated actions. | Application logs from LangChain/ADK/Microsoft Agent Framework/CrewAI, process file access monitoring, network connection logs from application servers | Execution | High — normal agent framework save/reload cycles and caching behavior may produce similar patterns. |
| Consider hunting for Node.js processes that spawn from unexpected locations, load Brotli-compressed payloads, or install root certificates into the local certificate store. | EDR process execution logs, certificate store modification events, file system monitoring for .br files associated with Node.js processes | Collection | Low — Node.js processes installing certificates or loading compressed bytecode from non-standard paths is unusual in most environments. |
| Consider hunting for processes exhibiting multiple data collection behaviors simultaneously (keylogging, screenshot capture, browser credential file access, Telegram session file access) originating from a single Node.js or bundled runtime process. | EDR process behavior telemetry, file access monitoring for browser credential stores and Telegram session directories, API call monitoring | Collection | Low — the combination of these behaviors from a single process is highly indicative of malware. |
Control Gaps
- Signature-based antivirus and EDR may not detect BTR driver misuse because the driver performs legitimate operations as designed
- Standard malware reverse engineering tools cannot parse compiled V8 bytecode, delaying analysis and detection rule creation for JSCeal
- AI agent framework serialization and caching layers are typically not monitored by security tooling, allowing poisoned content to trigger exploitation without detection
- Boot-phase kernel activity may occur before EDR agents fully initialize, creating a visibility gap for BTR driver operations
- Application security testing may not cover framework-internal deserialization paths that process attacker-controlled content
Key Behavioral Indicators
- Kernel driver performing bulk deletions of security product files or registry keys during boot phase
- Node.js process accessing browser credential stores, cryptocurrency wallet files, and Telegram session directories within a short time window
- Installation of a root certificate into the local certificate store by a non-administrative or unexpected process
- AI agent framework process making unexpected network calls or file writes immediately after content deserialization or cache reload events
- Presence of Brotli-compressed files (.br) loaded by Node.js processes from temporary or user-writable directories
False Positive Assessment
Medium — The BTR driver performs legitimate operations by design, making behavioral detection prone to false positives if not carefully tuned. AI agent framework serialization behaviors are normal application operations that could generate noise. JSCeal's behavioral indicators (certificate installation, multi-source data collection) are more distinctive but could still overlap with legitimate software in some environments.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing the BTR_CLI tool and associated behavior-based detection guidance released by Check Point Research to assess whether your EDR can detect misuse of the BTR driver.
- If your organization uses any of the affected AI agent frameworks (LangChain, Google ADK, Microsoft Agent Framework, CrewAI), consider checking for available patches for the twelve disclosed CVEs and evaluating whether your deployment exposes serialization or caching paths to untrusted input.
- Consider hunting in your environment for Node.js processes exhibiting behaviors consistent with JSCeal (certificate installation, access to browser credential stores, Telegram session directories) using the behavioral indicators described in the talk.
Infrastructure Hardening
- Consider evaluating whether kernel-level file operation monitoring (ETW providers) can be enabled to detect BTR driver misuse during boot phases.
- If running AI agent frameworks in production, consider implementing input sanitization and content scanning before content enters agent memory or context, and evaluate whether framework serialization paths can be restricted to trusted content only.
- Consider deploying network-level detection for unexpected certificate installations or HTTPS interception proxy behavior on endpoints.
- Where supported by your tooling, consider application-level monitoring for AI agent framework deserialization events that trigger file or network operations.
User Protection
- Consider ensuring endpoint protection includes behavioral monitoring for certificate store modifications by unexpected processes.
- If applicable, consider restricting Node.js execution to approved paths and monitoring for bundled runtime packages that load compressed bytecode.
- Evaluate whether your EDR supports early-boot kernel activity monitoring; if not, consider supplementing with Windows native kernel ETW logging.
Security Awareness
- Consider briefing development teams building AI agents on the risks of framework-internal serialization and caching vulnerabilities, emphasizing that poisoned content can trigger exploitation without direct tool invocation.
- If your organization has a threat intelligence or malware analysis team, consider evaluating the released V8 bytecode deobfuscation toolkit for integration into existing analysis workflows.
- Consider incorporating awareness of compiled bytecode malware formats into existing security training for analysts who may encounter non-standard payload delivery mechanisms.
