The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download extra programs onto infected computers, Russian cybersecurity firm Kaspersky said in a report Thursday. Researchers suspect the operation involved a supply-chain attack, in which hackers compromise trusted software or its distribution process to gain access to their intended targets.
Kaspersky detected the malware on one computer in the first half of 2026. Its analysis suggested the attack was tailored to a specialized version of Windows 10 used exclusively by government organizations in Asia.
Kaspersky did not identify the country or government agency involved, and it remains unclear how many systems may have been affected. The company said it could not link the attack to any known state-sponsored hacking group.
The malware was discovered inside a package stored in a directory used for Windows operating system updates. The package contained legitimate software components, including files belonging to the third-party update management tool Patch My PC and programs digitally signed by Microsoft.
