Malware · 3h ago
Kaspersky identified a previously unknown NetamLoader infection chain in the first half of 2026, targeting a government-customized Windows 10 build used in Asia.
The chain began with a Cabinet (CAB) archive in Windows’ update-package directory. Most files inside were legitimate Patch My PC components, and the .NET assemblies used were Microsoft-signed; a malicious configuration file used AppDomainManager injection to make the host load additional code. Familiar files and valid signatures therefore did not make the package safe.
Kaspersky did not observe how the archive reached the system, so the report does not establish that Windows Update itself was compromised. The exposure shown is specific to this custom government build; it does not establish a wider risk to ordinary Windows 10 deployments.
2 sources covering this story
The Record from Recorded Future
Hackers target government Windows systems in Asia with new malware
The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Kaspersky researchers analyze a complex targeted attack employing NetamLoader, a sophisticated malicious framework and targeting a customized government OS.
Part of the PlainSec briefing for 2026-10-30