Kaspersky detailed NetamLoader malware this week: a previously undocumented .NET loading framework found on one government Windows 10 system in Asia. The artifact was detected in the first half of 2026. The files sat inside Windows Update download folders and started through components of Patch My PC, Windows endpoint and patch-management software. The Windows PCs used to administer websites warrant scrutiny even when the CMS shows no signs of compromise.
Key takeaways
- Kaspersky found NetamLoader on one Asian government Windows 10 system in the first half of 2026, with no named threat actor and no confirmed data theft.
- A CAB under Windows Update's SoftwareDistributionDownload and DownloadInstall folders carried four legitimate Patch My PC binaries; only Resources.resx embedded the malicious code.
- AppDomainManager injection started from PatchMyPC-ScriptRunner.exe, and the final plugin beaconed from dllhost.exe to openaigpt4v[.]com after a random 20-40 minute wait.
- A Patch My PC supply-chain breach and a China victim remain unconfirmed, and the report published no CVE. Site risk sits on Windows admin PCs that store panel, SSH, SFTP, and database credentials.
What is NetamLoader malware, and who was actually hit?
NetamLoader malware is a .NET assembly-loading framework. Kaspersky detailed the findings this week. Detection fell in the first half of 2026.
Telemetry showed one victim: a government organization in Asia on a Windows 10 build used only by government entities in Asia. Kaspersky named no threat group and could not confirm that data left the machine or that a second system was hit.
The country stays unpublished. The Hacker News notes Microsoft’s Windows 10 China Government Edition for Chinese government and state-owned entities and treats that build as a possible fit. That reading is speculation. Bloomberg reported earlier this August that China’s Ministry of State Security ordered some agencies off the Government Edition and onto Chinese-made Linux distributions over data security concerns. That policy story does not identify the NetamLoader host.
How did NetamLoader get into Windows Update folders?
The malicious artifact arrived as a Windows cabinet (CAB) archive in the Windows Update download tree, under C:WindowsSoftwareDistributionDownload, then extracted into C:WindowsSoftwareDistributionDownloadInstall.
SoftwareDistribution is Windows Update’s working storage. Those subdirectories are normally writable by privileged accounts, so a file there means a privileged updater, deployment service, or administrator could write it. The hash-like subfolder name provides no provenance, so it remains unclear whether Microsoft pushed the cabinet through Windows Update.
The archive held seven files. The four PatchMyPC-* files are legitimate vendor binaries: PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, and PatchMyPC-ScriptRunner.exe.config. fabric.config and Microsoft.HostIntegration.Connectors.dll carry the loader configuration. Only Resources.resx embeds malicious code.
Execution begins when PatchMyPC-ScriptRunner.exe starts and its .config file redirects the .NET runtime. Kaspersky suspects a supply-chain compromise of a trusted third-party vendor. The exact vehicle that dropped the CAB remains unknown, so a breach of Patch My PC itself stays a suspicion.
The process that matters is the privileged writer of the Download and Install folders: Windows Update, BITS, or an endpoint-management agent. Patch My PC deployment logs can document that write. They do not create the directories by themselves.
Why does AppDomainManager injection hide NetamLoader so well?
AppDomainManager injection lets a companion configuration file hijack .NET Framework startup so malicious code runs inside a legitimate process. The Hacker News compares that result to DLL sideloading. A .NET executable’s .config can name an appDomainManagerAssembly and type, and the CLR loads that assembly while the application domain initializes.
PatchMyPC-ScriptRunner.exe can stay unmodified, so hashing only the EXE misses the redirect. Microsoft.HostIntegration.Connectors.dll reads fabric.config in the same directory and loads Resources.resx, which holds layers of encoded, compressed, or encrypted XAML, .NET assemblies, and JSON.
XAML-1 loads XAML-2. XAML-2 loads two compressed Base64-encoded XAML files: XAML-2-1, used to bypass the Antimalware Scan Interface, and XAML-2-2, which brings in .NET 1 Loader plus a JSON payload called JSON-1. JSON-1-c stores command-and-control configuration, including the server openaigpt4v[.]com. JSON-1-p carries a Base64-encoded .NET 2 Plugin and compressed, encrypted XAML templates used to build XAML-3.
.NET 1 Loader decrypts, assembles, and loads XAML-3, reports status to the server, and deletes the CAB extracts plus CLR usage logs and Windows Prefetch entries. XAML-3 runs inside dllhost.exe, Microsoft’s COM surrogate, and loads .NET 2 Plugin there. The plugin checks that its host is dllhost.exe, reads system information from the Registry, loads the C2 configuration, then waits a random 20-40 minutes before the first beacon. It then polls for XAML tasks and runs them in an isolated AppDomain.
A valid C2 response produces a 5-6 minute pause. Any other result produces a 22-28 hour pause, with a check every 10 minutes. A short sandbox run can still look clean because of the initial 20-40 minute delay.
What should you look for in dllhost.exe?
dllhost.exe normally lives in C:WindowsSystem32 or C:WindowsSysWOW64, and its command line often includes a /Processid argument with a GUID. Parent process, path, loaded .NET assemblies, and network destinations separate a normal COM surrogate from this loader. When the timeline matches a .NET loader, capture memory and EDR telemetry before the process is killed.
Does this put your website at risk?
The published victim is a government Windows 10 system, so a typical WordPress or Joomla site on shared hosting falls outside the named target set. The risk for a small business lies with the Windows PCs that hold hosting credentials: the laptop that opens RDP, the desktop that stores SFTP keys, the admin workstation that runs a panel session.
The same pattern showed up when a tampered editor extension put site passwords on a developer PC, which we covered in the piece on Claude Code 2.1.313 risk on the editor laptop. A core, plugin, or theme update leaves C:WindowsSoftwareDistribution and that PC untouched.
The reported chain includes no CVE, website exploit, web shell, or web-server payload. If that admin channel is abused, panel passwords, SSH keys, and database credentials stored on the PC are the assets at stake. Deleting Prefetch and CLR logs removes convenient host artifacts. Sysmon or EDR telemetry, proxy and DNS logs, the NTFS change journal, memory-resident assemblies, and network-flow records can remain.
Start on the Windows machines that administer the site. Look for unexpected CAB contents and Patch My PC binaries under SoftwareDistributionDownload and SoftwareDistributionDownloadInstall. Preserve and hash all seven files before anyone deletes them, especially PatchMyPC-ScriptRunner.exe.config, fabric.config, and Resources.resx.
On the host, look for dllhost.exe hosting .NET activity whose parent is outside normal COM activation; gaps in Prefetch and CLR usage logs on a host that otherwise looks maintained; the privileged writer behind the Install directory, checked against Patch My PC logs; and DNS or proxy hits for openaigpt4v[.]com. Those signs still need corroboration before anyone labels the host NetamLoader.
Hunt network activity across several days. The first beacon falls inside the opening 20-40 minutes, which is why a short sandbox often looks clean. The 22-28 hour pause after a failed response is why a single overnight capture is not enough. The Hacker News account names that server and publishes no CVE and no removal patch. A routine Windows update or a Patch My PC product update leaves the staged files in place until someone accounts for them.
If the admin PC is suspect, rotate panel, SSH, SFTP, Git, and database passwords from a known-clean machine, and keep a copy of the staged files for whoever handles the case. Malware removal work starts from that preserved evidence rather than from a filename search alone. Kaspersky’s supply-chain suspicion stays unconfirmed until the write provenance is established.
FAQ
Was more than one organization hit by NetamLoader?
Kaspersky telemetry identified a single victim, a government organization in Asia. The researchers could not confirm that a second system was compromised.
Did Kaspersky name a threat group behind NetamLoader?
No. Neither Kaspersky nor The Hacker News ties the activity to a known threat actor.
Are the Patch My PC files in the archive all malicious?
The four PatchMyPC-* files are legitimate vendor binaries. fabric.config and Microsoft.HostIntegration.Connectors.dll carry the loader configuration. Only Resources.resx embeds malicious code.
Can NetamLoader infect a WordPress site by itself?
The reported chain contains no website exploit, web shell, or CMS payload. A site is exposed when a Windows admin PC that already holds hosting credentials is compromised.
If an admin PC that logs into your site is already in question, start with preserved files and fresh credentials, then put the site on a security package that watches it after the workstation is cleaned.