Kaspersky said it found NetamLoader, a new malware framework aimed at a custom Windows build used only by government bodies in Asia. A detection alert in the first half of 2026 flagged a settings file in a compressed CAB package, stored where Windows keeps update packages. The package held genuine components of Patch My PC, a patch management tool, plus Microsoft-signed .NET files. First checks found no harmful code.
Kaspersky said a trusted program reads its settings file before it starts. Here, crafted settings files told the signed programs to load the attackers' code, hidden in layers of encoded and encrypted data. The malware also made Windows' built-in scan interface report every scan as clean. Kaspersky saw one victim in Asia, inferred government targets, and linked no known hacking group. It does not say how the archive reached the machine.
This case suggests a signature or vendor name proves little when a settings file steers the program. Leaders could ask: does anyone watch the update folder? Why are signed files trusted? Are update logs kept where attackers cannot edit them?