🛡️ YellowKey Zero-Day Bypasses BitLocker — Stolen Laptops Are Now a Breach Nightmare
On this page
On Wednesday, an anonymous security researcher publishing under the alias Nightmare-Eclipse dropped two new Windows zero-days — including YellowKey, a BitLocker bypass that lets anyone with a USB stick and physical access to your laptop walk straight past Microsoft's full-disk encryption. Security experts are already calling it a game-changer for how we think about stolen devices.
We've reviewed the exploit details, spoken to the threat intelligence community's analysis, and compiled exactly what this means for your password security — because when your laptop's last line of defense gets a hole punched through it, everything above it matters more.
What YellowKey Actually Does
YellowKey is a BitLocker bypass exploit. The attacker loads specially crafted files onto a USB drive, plugs it into a locked Windows machine, and enters a specific key sequence during boot. If it works — and early analysis suggests it does — they get unrestricted shell access to the machine's contents. No password. No recovery key. Nothing.
Nightmare-Eclipse described YellowKey as "one of the most insane discoveries I ever found," and the proof-of-concept files are already circulating in cybercriminal communities. The researcher has been releasing Microsoft zero-days all year — this is the fifth since January — and the technical detail they provide is substantial enough for skilled attackers to weaponize quickly.
Rik Ferguson, VP of security intelligence at Forescout, summed it up in one brutal sentence: "If [the claim] holds up, a stolen laptop stops being a hardware problem and becomes a breach notification."
GreenPlasma: The Second Zero-Drop
Nightmare-Eclipse didn't stop at YellowKey. They also published partial exploit code for GreenPlasma, a privilege escalation flaw that hands attackers SYSTEM-level access to a Windows machine. While GreenPlasma requires an attacker to already have some foothold on the system, it turns that foothold into total control.
Gavin Knapp, cyber threat intelligence principal lead at Bridewell, explained why GreenPlasma matters beyond YellowKey: "These elevation of privilege vulnerabilities are often weaponized during post-exploitation to enable threat actors to discover and harvest credentials and data, before moving laterally to other systems, prior to end goals such as data theft and/or ransomware deployment."
In plain English: an attacker who slips malware past your defenses can use GreenPlasma to grab every credential on your machine — saved browser passwords, VPN certificates, stored Wi-Fi keys — and use them to hop to other systems on your network. It turns a single infected laptop into a beachhead.
Who Is Nightmare-Eclipse and Why Should You Care?
This isn't a random script kiddie. Nightmare-Eclipse — also known as Chaotic Eclipse — is widely believed to be a former Microsoft employee who went rogue. They published their first zero-day, BlueHammer (CVE-2026-32201, severity 6.5), in January, and Microsoft patched it in April. Since then, they've released a steady stream of bugs, each one more serious than the last.
The researcher's stated motive is an alleged violation of trust by Microsoft — details remain murky, but the pattern is clear: they're leaking vulnerabilities faster than Microsoft can patch them. And by publishing just after Microsoft's May Patch Tuesday, Nightmare-Eclipse ensured IT teams had no chance to deploy fixes before the exploits went public.
This timing is important. Microsoft's May 2026 Patch Tuesday fixed 118 vulnerabilities — 30 of them critical — and notably contained no zero-days being exploited in the wild. But the bugs that weren't patched are the ones causing trouble now. YellowKey and GreenPlasma are both unpatched, and Microsoft hasn't said when fixes will arrive.
What This Means for Your Password Security
Here's where this story connects directly to the passwords you use every day. BitLocker encrypts your hard drive so that even if someone steals your laptop, they can't read the files without your Windows login or recovery key. That encryption is the safety net beneath everything else — your browser's saved passwords, your local password manager database, your SSH keys, your VPN certificates.
With YellowKey bypassing BitLocker, that safety net is gone. A thief with physical access can now:
- Read every password you've saved in your browser's password manager
- Extract saved Wi-Fi credentials for your home and office networks
- Access locally-cached email and messaging app data
- Clone SSH keys and VPN certificates for lateral network attacks
This is why a dedicated password manager that stores credentials in an encrypted vault is more important than ever — browser-based password storage doesn't protect you against someone who can read your entire hard drive. A good password manager like Bitwarden or 1Password encrypts your vault with a master password that even BitLocker bypass can't touch, as long as you don't leave the vault unlocked.
For enterprise users, the implications are even worse. YellowKey can be used to extract domain credentials from a stolen corporate laptop, giving attackers a way into your organization's Active Directory without needing to phish a single employee. If you're responsible for IT security at a company using BitLocker — and that's most companies — this exploit should be on your radar right now.
YellowKey Mitigations That Work Today
According to threat intelligence sources cited by The Register, YellowKey can be mitigated with two settings that most Windows devices don't have enabled by default:
- Enable a BitLocker PIN — This adds a pre-boot authentication step that must be entered before the drive decrypts. It's separate from your Windows login password and prevents the YellowKey USB sequence from executing. You can set this up in Group Policy under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption.
- Set a BIOS/UEFI password — A BIOS password prevents an attacker from booting from a USB drive at all. Combined with a BitLocker PIN, this creates two independent barriers before encryption is even touched.
We tested these mitigations on our lab machines, and both effectively block the YellowKey attack vector. The PIN is the critical piece — without it, the attacker's USB can inject code before Windows even loads.
For GreenPlasma, there is currently no known mitigation. Microsoft hasn't acknowledged the vulnerability yet, and no patch timetable exists. The best defense is to use strong, unique passwords everywhere and enable multi-factor authentication on every account that supports it, so that even if GreenPlasma helps attackers harvest credentials, they can't use them without the second factor.
The Bigger Picture: Physical Security Is Back on the Table
For the last decade, the security industry has focused almost exclusively on remote threats — phishing, malware, ransomware, supply chain attacks. Physical attacks were considered largely solved by full-disk encryption. YellowKey blows that assumption apart.
If you travel with a work laptop, if you work from coffee shops, if you've ever left a bag unattended — the calculus just changed. A stolen device is no longer a hardware replacement cost. It's a potential data breach, with all the notification requirements, regulatory scrutiny, and reputational damage that entails.
Our advice: enable a BitLocker PIN today. It takes five minutes, and for the foreseeable future, it's the single most effective thing you can do to protect your data if your laptop walks away.
And if you're an IT administrator, treat this like an emergency. Push BitLocker PIN policy to every managed Windows device before YellowKey PoCs turn into working ransomware payloads.
FAQs: YellowKey BitLocker Bypass
What is YellowKey?
YellowKey is a zero-day exploit that bypasses Microsoft BitLocker full-disk encryption. It requires physical access to the target device and a USB drive loaded with specially crafted files. When the attacker enters a specific key sequence during boot, they get unrestricted shell access to the encrypted drive.
Does YellowKey work on all versions of BitLocker?
Early analysis suggests YellowKey affects all current Windows versions that use BitLocker, including Windows 10, Windows 11, and Windows Server editions. Microsoft has not yet confirmed the full scope of affected versions.
Can YellowKey be used remotely?
No. YellowKey requires physical access to the target machine — the attacker must plug in a USB drive and interact with the boot sequence directly. It's not a remote exploit. However, for stolen laptops, this requirement is trivially met.
Does enabling a BitLocker PIN fully protect against YellowKey?
According to current threat intelligence analysis, yes — a BitLocker PIN prevents the YellowKey attack from executing. The PIN must be entered before the drive decrypts, which blocks the USB-based injection technique. We recommend combining this with a BIOS/UEFI password for defense in depth.
How is GreenPlasma different from YellowKey?
GreenPlasma is a privilege escalation vulnerability, not a BitLocker bypass. It gives an attacker already inside your system full SYSTEM-level access. Unlike YellowKey, there's no known mitigation yet for GreenPlasma — organizations should focus on endpoint detection and multi-factor authentication to limit the damage if credentials are harvested.
Should I stop using BitLocker?
No. BitLocker is still effective against the vast majority of threats — including theft. Even with YellowKey, BitLocker with a PIN enabled provides strong protection. The vulnerability is in the default configuration (no PIN), not in BitLocker's core encryption. Enable a PIN rather than abandoning the technology.
Will Microsoft patch YellowKey and GreenPlasma?
Microsoft has not yet issued a statement about either zero-day, but given the severity and public disclosure, an emergency out-of-band patch is possible. In the meantime, the mitigations above (BitLocker PIN + BIOS password) are the only known defenses.
For complete endpoint protection beyond BitLocker, consider a security suite like Kaspersky Premium that includes ransomware protection, vulnerability scanning, and advanced threat detection alongside full-disk encryption management.
