Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
YellowKey: CVE-2026-45585. Patched June 09, 2026 (Patch Tuesday).
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is the eighth tool from this researcher in roughly ten weeks, and the second BitLocker bypass in the cluster after YellowKey.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Only of interest is perhaps: \??\C:\Windows\win.ini and \??\X:\Windows\System32\winpeshl.ini Where X:\Windows\System32\winpeshl.ini is what controls what WinRE does when it fires up.
A malicious binary — autofstx.exe — is injected into this value, executing before the operating system fully loads and bypassing BitLocker’s pre-boot authentication entirely.
YellowKey is a Windows login bypass for an attacker with physical access... with physical access, you can access the filesystem with root privileges... Transactional NTFS bits on a USB Drive are able to delete the winpeshl.ini file on ANOTHER DRIVE ( X: ). And we get a cmd.exe prompt, with bitlocker unlocked instead of the expected Windows Recovery environment.
The vulnerability originates in WinRE’s handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager. A malicious binary — autofstx.exe — is injected into this value, executing before the operating system fully loads...
Only of interest is perhaps: \??\C:\Windows\win.ini and \??\X:\Windows\System32\winpeshl.ini Where X:\Windows\System32\winpeshl.ini is what controls what WinRE does when it fires up.
A malicious binary — autofstx.exe — is injected into this value, executing before the operating system fully loads and bypassing BitLocker’s pre-boot authentication entirely.
YellowKey is a Windows login bypass for an attacker with physical access... with physical access, you can access the filesystem with root privileges... Transactional NTFS bits on a USB Drive are able to delete the winpeshl.ini file on ANOTHER DRIVE ( X: ). And we get a cmd.exe prompt, with bitlocker unlocked instead of the expected Windows Recovery environment.
And we get a cmd.exe prompt, with bitlocker unlocked instead of the expected Windows Recovery environment.
In addition, two other exploit tools named “YellowKey” and “GreenPlasma” were reportedly released this month. “YellowKey” is described as a BitLocker bypass mechanism affecting TPM-only BitLocker configurations on Windows 11 and Windows Server 2022/2025 systems.
we tested this ourselves, and sure enough, not only does it work, it bears all the hallmarks of a backdoor, down to the exploit's files disappearing from the USB stick after it's used once.
The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker... to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM).
The result is a shell with unrestricted access to the BitLocker-protected volume, exposing all encrypted data without requiring the recovery key, PIN, or any credential.
On May 12, 2026, Chaotic Eclipse published a working proof of concept demonstrating a zero-day BitLocker bypass affecting Windows 11, Windows Server 2022, and Windows Server 2025. The technique requires approximately 60 seconds of physical access and a standard USB device, enabling a SYSTEM-level command shell with full access to a BitLocker-protected volume, without the need for a password, recovery key, or specialized tooling.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named BitLocker bypass referenced as historical context for similar bypass issues.
Named item tied to CVE-2026-45585 in the Chaotic Eclipse disclosures; Sophos lists detection as Troj/YellowKy-A. The related vulnerability is already known to be exploited in the wild.
Another BitLocker bypass in the same Nightmare-Eclipse tool cluster, referenced as a prior related capability.
A prior exploit in the same researcher cluster targeting Microsoft Defender or adjacent Windows security components, patched in June 2026.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.