NetamLoader hides in Windows 10 update packages aimed at Asian governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
72
Product
Windows 10
- Mentions · 7d4
- Mentions · 30d7
- All mentions21
- First seenAug 19, 2026
- Last mentioned20h ago
Timeline
21 articles · newest firstKaspersky finds NetamLoader on one Asian government Windows system
The loader uses signed Microsoft components, can hide activity, and its delivery path is unconfirmed.
72
Unknown APT deploys NetamLoader on government Windows 10 builds in Asia
Kaspersky traced a CAB in the Windows update folder to AppDomainManager injection and a layered .NET loader.
72
Microsoft Windows updates remove trust in weak eMudhra certificates
October 26 updates target offline Windows systems after eight April 2025 intermediate keys proved recoverable.
74
SPECTER uses USB power control to exfiltrate data from air-gapped hosts
Charging-state signaling reached 0.2-0.25 bit/sec; a USB mouse on Windows reached 1.0 bit/sec.
48
Microsoft Patches More Than 1,400 Security Flaws
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
80
Microsoft: Outdated Windows devices will stop receiving security updates
Unsupported Windows devices will lose security updates after Windows Update certificates expire in 2027.
55
Microsoft fixes bug that broke Windows File History backup feature
Microsoft fixed a September update bug that stopped File History backups on Windows 10 and 11.
44
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
Microsoft: September Windows updates break Always On VPN connections
September 2026 Windows updates break Always On VPN connections when automatic protocol selection is enabled.
45
Microsoft Confirms September 2026 Windows Updates Break File History Backups
Microsoft September 2026 updates break Windows File History backups, prompting users to manually verify backup status.
45
Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs
Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.
70
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
80
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
85
Serial Microsoft 0-day hunter drops yet another Defender exploit
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.
55
Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
86
Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code
Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.
58
Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.
50
September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
84
Microsoft releases Windows 10 KB5122878 extended security update
Microsoft shipped Windows 10 ESU update KB5122878, delivering the record September 2026 Patch Tuesday fixes, including patches for two actively exploited zero-days.
48
Critical RCE flaw in Windows IKE Extension now actively exploited
CISA warns CVE-2026-33824, a critical unprivileged RCE in Windows IKE Extension, is now actively exploited.
88
Related CVEs
by mentions- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2026-697301%9.8Use-After-Free RCE in Windows DNS Server
- CVE-2026-69590<1%9.8Unauthenticated RCE in Microsoft Windows Routing and Remote Access Service (RRAS)
- CVE-2026-69485<1%8.8Use-of-Uninitialized-Resource RCE in Microsoft Windows Remote Desktop Client
- CVE-2026-694141%7.8Local Elevation of Privilege in Microsoft Defender Malware Protection Engine
- CVE-2026-5065611%7.0Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet "
- CVE-2026-69449<1%6.7Heap-Based Buffer Overflow in Windows BitLocker Enables Local Code Execution
Appears with
- Microsoftvendor · 20
- Windows 11product · 15
- Windows Serverproduct · 7
- Microsoftorganization · 7
- NetamLoadermalware · 3
- Patch My PCproduct · 3
- Googlevendor · 3
- Kasperskyorganization · 3
- UNK_LateNightthreat actor · 2
- GemStonemalware · 2
- APT31threat actor · 2
- SSTPproduct · 2
- IKEv2product · 2
- Violet Typhoonthreat actor · 2
- File Historyproduct · 2
- ShadowPadmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.