Vengeful Windows exploit researcher reveals his true identity

The researcher behind months of relentless Windows exploit disclosures has finally dropped the mask: Nightmare Eclipse is Abdelhamid Naceri, a former Microsoft security researcher based in Germany.

In a series of revealing posts on X over the weekend, Naceri claims that he was just a few months away from getting permanent EU residence in Germany before Microsoft fired him.

Naceri also alleges that Microsoft kept his account open for two months after his notice period to try and tempt him into a "legitimate way” to fire him, but that he resisted.

Disclosure day for Nightmare Eclipse

The disclosure puts a name to a researcher who, also using handles including Chaotic Eclipse, MS Nightmare, and Infinite Nightmare, has repeatedly published Windows exploits amid a bitter and highly personal dispute with his former employer.

It's the latest twist in a saga that saw Nightmare Eclipse blow up Microsoft's September Patch Tuesday last week, dropping ShieldCrash – a proof-of-concept (PoC) he claims tears straight through the company's ShieldBreak Defender patch.

A series of candid posts on X flagged as “STORY TIME” reveal how a legal battle with Microsoft has taken its toll on Naceri, who says he is now being treated in a psychiatric hospital.

He also shared his termination letter from Microsoft for the first time, which informed him in March 2025 that his employment would end in June of that year.

The letter, written in German and detailing the dates of his dismissal, reveals that Naceri was immediately released on three months of gardening leave, but does not give a reason for his termination.

He also claims that despite informing him of his dismissal, Microsoft did not immediately shut off his account for another two months, which gave him access to internal resources.

The dismissal appears to have had consequences far beyond his job. Naceri says he was only months away from securing permanent residence in Germany when Microsoft fired him.

Staying in the country, he says, is subsequently one of the central issues in his fight against the termination.

He claims the dispute eventually cost him more than $200,000 and alleges that he rejected a settlement of €55,000 plus a year's pay to drop the case from Microsoft because he wanted the company to help him remain in Germany.

My one and only condition was wanting to stay in Germany, which was an easy thing to do for Microsoft but they refused,

– Abdelhamid Naceri AKA Nightmare Eclipse on X

Not everything Naceri has previously said about the dispute has proved accurate. In one of his latest posts, he retracted an earlier assertion that his former employer had sued him, writing “MS never sued, I lied.”

The identity reveal comes as Naceri’s posts have become more personal, reflecting on his recent struggles with his former employer and his mental health.

He says he is currently receiving treatment in a psychiatric hospital.

Other recent posts describe living in “Extreme isolation and solitude" and struggling with the personal fallout from the dispute.

Cybernews has reached out to Microsoft for comment.

Windows security “idol”

The security community meanwhile appears to have known Naceri’s work way before his Nightmare Eclipse era.

One researcher described Naceri as an “idol” and recalled following his Windows research years earlier, praising his ability to find unusually creative vulnerabilities across major security products and Windows components.

Others reading the posts had less sympathy, accusing the researcher of dropping zero-days while still working for Microsoft.

I may be mistaken, but it appears that you were already releasing zero-day vulnerabilities on websites before your termination, which is why you were let go. That’s just how it reads to me.

– Poster @Flatlinedixie13 writes on X.

While @gmhzxy advised, “Separate the hobby from the job. It’s the only way both survive.”

Banned from GitHub

Since April, Nightmare Eclipse has disclosed roughly 14 zero-day exploits in total – nine of them targeting Windows and Defender directly, with the rest hitting third-party security tools like CrowdStrike, NVIDIA, Kaspersky, and Avast.

The largest code-sharing platforms, GitHub and GitLab, blocked the researcher’s accounts and wiped his code, but this did not prevent him from changing his name and posting on a series of independent repositories.