Researcher publishes FalconFlank zero-day targeting CrowdStrike Falcon Sensor

Key points

• A researcher using the handle Chaotic Eclipse published proof-of-concept code on GitHub for a zero-day flaw in CrowdStrike Falcon Sensor, the security software installed on millions of corporate Windows PCs.
• The bug, named FalconFlank, abuses Falcon's built-in cleanup of malicious Microsoft Office macros to gain SYSTEM privileges, the highest level of access on a Windows computer.
• CrowdStrike had not issued a fix at the time of publication, making this a true zero-day: a defect the vendor did not know about before it went public.
• The technique targets the endpoint agent itself, turning a defensive feature into an attack path.
• IT teams must update Falcon once CrowdStrike ships a fix; ordinary users can't patch this themselves.

A security researcher going by Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare or Nightmare-Eclipse, has published a working attack against CrowdStrike Falcon, one of the most widely deployed corporate security products in the world.

The flaw is called FalconFlank. According to a README on the researcher's GitHub page, first reported by The Hacker News, it's a privilege escalation bug. An attacker who already has a foothold as a normal user on a Windows PC can use FalconFlank to become SYSTEM, the all-powerful account Windows itself runs under. Once you're SYSTEM, the machine is yours.

This is the same researcher we covered on 12 August when Chaotic Eclipse published ShieldBreak, a proof-of-concept claiming to bypass a Microsoft Defender patch.

What is CrowdStrike Falcon and why does this matter?

Falcon is an endpoint detection and response agent, a small program installed on company laptops and servers that watches for malware and stops it. Banks, hospitals and government departments run it on huge fleets of machines. When a defensive tool with that much reach has a hole in it, the blast radius is large.

FalconFlank doesn't exploit some obscure component. It abuses Falcon's feature that cleans up malicious Office macros, the scripts embedded in Word or Excel files that criminals have used for years to deliver malware. That cleanup runs with high privileges, and the researcher found a way to hijack it and ride those privileges to SYSTEM.

The failure mode is a classic one: a security product doing sensitive work on behalf of a low-privileged user without properly checking what it's acting on. The post-mortem will note that trusted paths and file operations inside an EDR agent need the same paranoid handling as a kernel driver.

Should CrowdStrike customers be worried?

Yes, but with context. FalconFlank isn't a way for a stranger on the internet to break in from scratch. The attacker needs to already be on the machine as a normal user. What it gives them is the last mile: full control of the box, and the ability to tamper with the very tool meant to catch them.

That's exactly the kind of primitive ransomware crews and state-backed groups pay for. Disabling the EDR is step one of most modern intrusions.

What should IT teams do right now?

Watch CrowdStrike's support portal for an out-of-band sensor update and stage it fast when it lands. Until then, tighten the basics: restrict local admin, block Office macros from the internet by policy, and alert on any process spawning from Falcon's remediation paths.

The vendor PR spin will likely stress that exploitation requires local access. True. Also true: local access is cheap, and every phishing click is a candidate foothold.

Your EDR is code running as SYSTEM on every endpoint you own. Patch it like you patch the kernel, not like you patch a browser plugin.