GhostTree weaponizes recursive NTFS junctions to stall Windows Defender scans
GhostTree creates self‑referencing junctions that generate endless valid paths, causing Microsoft Defender and other EDR tools to loop forever during folder scans. The result is malware hidden in the same directory stays undetected until the scan times out or is aborted. This technique requires only write access, no admin rights.