Kaspersky finds NetamLoader in Windows update files on Asian government systems
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.
72
Malware
NetamLoader
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenOct 29, 2026
- Last mentioned5h ago
Timeline
4 articles · newest firstNetamLoader hides in Windows 10 update packages aimed at Asian governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
72
Kaspersky finds NetamLoader on one Asian government Windows system
The loader uses signed Microsoft components, can hide activity, and its delivery path is unconfirmed.
72
Unknown APT deploys NetamLoader on government Windows 10 builds in Asia
Kaspersky traced a CAB in the Windows update folder to AppDomainManager injection and a layered .NET loader.
72
Appears with
- Microsoftvendor · 4
- Kasperskyorganization · 4
- Patch My PCproduct · 4
- Windows 10product · 3
- Zapchastmalware · 1
- Windowsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.