Security researchers have found new malware that tried hard to stay hidden, and sharing the details early helps others prepare. Kaspersky’s Global Research and Analysis Team found the NetamLoader malware aimed at a customised version of Windows 10 used only by government bodies in an Asian country. Kaspersky spotted one victim through its threat monitoring network and has not linked the attack to any known group. The team presented its findings at the Security Analyst Summit 2026 in Bali, giving defenders a head start.
The investigation began in the first half of 2026, when researchers noticed a suspicious configuration file inside an archive in a Windows update folder. Most programs in the archive were real, including parts of the Patch My PC tool and a Microsoft-signed module. The attackers changed supporting files so this genuine software would load their instructions, which made the NetamLoader malware harder to spot. Researchers did not see how the archive reached the victim, and nothing suggests Patch My PC or its systems were compromised.
Once it starts, the malware unpacks its hidden content through several layers of encoding, compression and encryption. It then moves into a real Windows process, which makes the link to the original program harder to trace. It also interferes with an anti-malware scanning function and deletes files that could help investigators rebuild the attack. After that, the NetamLoader malware waits 20 to 40 minutes before it contacts a server run by the attackers.
Simple Checks That Help Defenders
If the server does not answer, the malware waits 22 to 28 hours before trying again, so short monitoring sessions may see little activity. Sergey Lozhkin, Head of Kaspersky GReAT Research Center, APAC and META, said, “This case shows why defenders need to look at how components interact, not only whether each program is legitimate.” That advice helps any team that wants to catch the NetamLoader malware early, and Kaspersky products detect it as HEUR:Trojan.MSIL.NetamLoader.gen. The full technical report, including indicators of compromise, is on Securelist for teams that want the details.
Kaspersky advise users to check the folder where Windows keeps downloaded updates for unexpected programs or configuration files, and confirm where every update package came from. Allow third-party management tools to run only from approved locations so that unexpected copies stand out. Keep logs on a separate system too, because the malware deleted local cache files, .NET usage logs and update records.
