Kaspersky traces NetamLoader malware hidden in a Windows update directory

Kaspersky has detailed a complex .NET malware framework it calls NetamLoader, found in a CAB archive stored in a Windows directory used for update packages. The report says the infection chain strongly indicates a supply-chain attack targeting a customised Windows build used by government entities in Asia, but does not identify a known attacker.

Watch Desk analysis

What happened

Kaspersky says the sample first came to light in the first half of 2026, when its security network flagged a configuration file using AppDomainManager injection to load .NET assemblies. The file was packaged with components of the Patch My PC patch-management tool. Initial inspection looked deceptively ordinary: most executables were legitimate, and even the injected assemblies were Microsoft-signed. A later examination of the configuration and loading process exposed the malicious chain.

The report describes multiple layers of XAML, .NET assemblies and encoded or encrypted data. One stage interferes with the Windows anti-malware scanning interface, making later payloads harder to detect. Kaspersky says it did not observe how the CAB file reached the target, and says no attribution to a known threat group has been established.

Why it matters

The unnerving detail is not simply that malware used signed files. It was packaged alongside apparently legitimate software in a directory associated with Windows updates, then used a multi-stage loading process to conceal what followed. That makes the report relevant to defenders investigating suspicious update-related activity, while stopping well short of proving that Patch My PC itself was compromised.

Kaspersky’s findings concern a specific sample and a customised Windows environment. They do not establish how widespread the activity is or who was responsible. Those distinctions matter; “found in an update directory” is not the same as “Windows updates were compromised”.

Our read

This is a substantial technical account, not a reason to distrust every signed installer that crosses your path. The practical lesson is to investigate the chain of execution and configuration around a suspicious file, rather than treating familiar names and valid signatures as a clean bill of health. Malware, it turns out, can dress for the occasion.

What to watch

• Whether Kaspersky identifies further victims or related samples.
• Whether other researchers connect the activity to a known group.
• Whether defenders find evidence explaining how the CAB archive reached the system.

Discussion spark: When a suspicious update package contains mostly legitimate, signed components, which should carry more weight for defenders: trusted file signatures, or the full chain of behaviour around them?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.