Solved This seems to be a huge security flaw in Edge and MS Defender.

[rashmi]

Microsoft Defender lacks web protection and avoids engaging targets at long range to prevent disrupting air traffic; instead, it waits for the enemy to land before neutralizing the threat.

MD .22 Caliber—Just two inches from the head and bang—accuracy level: expert!

 

[annaegorov]

Microsoft Edge is clearly inconsistent in blocking all EICAR tests from the OP except for the phishing test.
Anyway, the postulate from the OP ( "This seems to be a huge security flaw in Edge and MS Defender") is untrue, especially when Microsoft has its own testground website:

Home - Microsoft Defender Testground

Untrue?

Well maybe its just the way my mind works. I know this is a test sight, and you guys know it is too. But my computer and software do not.

What I mean is... I go to the test site, the owners of the site say "You should NOT be able to see this page. If you can see it something is wrong (my words not theirs).

So I don't panic, because we all know this is a test page, but if my software for security doesn't stop this test page, then what happens when I accidently land on the real deal, will my software stop that?

In my mind, just using the logic, of knowing one page was allowed, then maybe all will be allowed. Thus I am in trouble.

 

[Andy Ful]

In my mind, just using the logic, of knowing one page was allowed, then maybe all will be allowed.

Unfortunately, this logic has nothing to do with antiphishing effectiveness. You have to include the probabilities in your logic.
For example, when testing a highly counterfeit coin that has a 99% probability of showing a tail, the first head can occur on the first throw with a probability similar to that on the 10th throw (the difference is very small).

 

[Andy Ful]

@annaegorov

Here is another example.
Suppose you selected a pair of US citizens and found them to be divorced. Is it reasonable to conclude that Americans divorce more often than other nations?

 

[Parkinsond]

@annaegorov

Here is another example.
Suppose you selected a pair of US citizens and found them to be divorced. Is it reasonable to conclude that Americans divorce more often than other nations?

Here we go with statistics

 

[Andy Ful]

Here we go with statistics

I am afraid so.
This problem is visible in the AV testing reports (several AVs tested against the same samples). The information on whether the missed sample was the first tested, the 10th, or the 400th does not affect the AV effectiveness, so it is skipped.

 

[annaegorov]

IF this comment is true, yikes.....

Just last week I found even easier way how to bypass whole windows security. Create crappy app, put it on Microsoft store, later release update with malware. All 3rd party antivirus starts screaming, but not Windows defender because it was legitimately downloaded via microsoft store. Even when I was trying to get to flagged file with local admin privileges, Windows won't let me. I was not even able to delete folder via cmd. The only way how to uninstall it was with user account originally used for install.

 

[Andy Ful]

IF this comment is true, yikes.....

Just last week I found even easier way how to bypass whole windows security. Create crappy app, put it on Microsoft store, later release update with malware. All 3rd party antivirus starts screaming, but not Windows defender because it was legitimately downloaded via microsoft store. Even when I was trying to get to flagged file with local admin privileges, Windows won't let me. I was not even able to delete folder via cmd. The only way how to uninstall it was with user account originally used for install.

This can happen, but such an attack vector is not effective in the wild due to the reputation filters.
Which crappy app did you have in mind?

 

[Andy Ful]

Here are some examples of abusing Microsoft Store:

https://atos.net/wp-content/uploads/2026/05/atos-malicious-proxyware-campaign-distributed-via-microsoft-store-applications.pdf

In this case, the malicious apps were undetected by EDR for about two months. However, this was possible because the malicious activity was limited to proxy abuse (no additional payloads, suspicious child processes, data theft, etc.).

 

[annaegorov]

This can happen, but such an attack vector is not effective in the wild due to the reputation filters.
Which crappy app did you have in mind?

Sorry for not giving more details Andy. I don't think the "commentor" left many details he just made the author; (PC Security Channel) aware that he had done so.

The video where the comment was made is here: