Attackers are exploiting a legacy Truesight driver, deploying over 2,500 variants to disable security software on Windows systems. This large-scale abuse highlights the urgency of securing outdated drivers and enforcing stricter security policies. Check Point Research found that attackers modify Truesight.sys v2.0.2 to bypass Windows protections, evade the Microsoft Blocklist, and deploy malware like Gh0st RAT. Most victims are in China and Asia. Microsoft updated its blocklist on Dec. 17, 2024, to counteract this threat.