Threat Summary
On September 3, 2026, a security researcher known as Nightmare Eclipse/Chaotic Eclipse publicly disclosed a zero-day dubbed ‘FalconFlank’ which abuses the Office malicious macro remediation workflow in CrowdStrike Falcon Sensor. The attack leverages a time-of-check to time-of-use (TOCTOU) race condition, allowing an attacker with code execution on a vulnerable system to hijack the Falcon macro remediation routine. This results in DLL side-loading and execution as NT AUTHORITY\SYSTEM.
The exploit is effective against fully-updated versions of Windows 11 (25H2) and Server 2025, provided CrowdStrike Falcon is running in Phase 3 Optimal Protection with the macro removal policy enabled. The PoC is publicly available on GitHub and can be leveraged by moderately skilled threat actors with development capability to achieve SYSTEM-level privileges. At the time of writing, no attacks have been reported.
CrowdStrike has not yet issued a public advisory or patch but recommends (via internal tech alert) that customers disable the affected macro remediation policy as an interim workaround. Detection is challenging. Hash-based antivirus signatures are easily bypassed, and only behavior-based monitoring, such as unusual SYSTEM processes spawned by csfalconservice.exe, abnormal DLL loads, or the presence of FalconFlank.exe can highlight malicious activity.
Recommendations
Immediate Actions:
- Disable the ‘Microsoft Office file Suspicious Macro Removal’ policy via the CrowdStrike Falcon console (Phase 3 policy setting). This is the only vendor-approved workaround and removes the attack vector for FalconFlank. Confirm policy propagation to all endpoints.
- Disclosure from CrowdStrike: “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.”
Short-Term Defensive Measures:
- Enforce Group Policy or endpoint controls to block macros from the Internet and disable all macros with notification in Microsoft Office (as a compensating control).
- Restrict the creation of NTFS symbolic links by non-privileged users where possible.
Long-Term/Strategic:
- Engage with CrowdStrike support to request direct advisory updates and private notifications about patch timelines and remediation steps.
- Retain enhanced endpoint monitoring and centralize event logs (Sysmon, SIEM, EDR detection) to catch adaptation of the attack or follow-on tools.
- Educate users on risks of macro-enabled Office documents; maintain regular security awareness campaigns focused on social engineering and macro attacks.
- Monitor for new advisories, patches, or CVEs from CrowdStrike and downstream OS security advisories, acting as soon as fixes are published.
Temporary Workarounds
- Officially documented workaround: Disable the ‘Microsoft Office file Suspicious Macro Removal’ policy from the Falcon console for all vulnerable Windows endpoints. This removes the primary FalconFlank exploit vector while retaining other protective capabilities.
- Enforce Office macro-restriction policies: Use Group Policy to block macros from the internet, set VBAWarnings to 4 (disable all macros with notification), restrict trusted locations and startup paths in Office.
References:
- https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
- https://thehgtech.com/articles/falconflank-crowdstrike-falcon-lpe-analysis.html
- https://github.com/MSNightmare/FalconFlank
- https://intelfusions.com/news/falconflank-falcon-macro-remediation-lpe
- https://socradar.io/blog/falconflank-crowdstrike-falcon-0day-poc
