Check Point Research presented three talks at Black Hat covering: (1) a Windows Defender kernel driver (BTR) with a hardcoded encryption key across all signed builds spanning Windows 7–11 25H2, enabling arbitrary Ring 0 operations with no CVE or patch; (2) twelve CVEs across four major AI agent frameworks where poisoned content triggers exploitation through framework serialization and caching internals without direct tool invocation; and (3) a deobfuscation pipeline for JSCeal, a V8 bytecode-compiled cryptocurrency stealer whose payloads include credential theft, keylogging, and HTTPS interception.
BTR Driver
1 post
Day 2 at Black Hat: Check Point Research Takes the Stage