Researchers have disclosed a previously undocumented loading framework, codenamed NetamLoader, found in a Windows 10 build made only for government use in Asia. The discovery, reported by Kaspersky and covered on 1 November 2026, is notable because the target was not ordinary consumer software, but a customised operating-system build used by state organisations.

The malicious sample was detected in the first half of 2026, hidden inside a Windows cabinet archive placed in a folder normally used for operating-system update downloads. Investigators suspect a supply-chain route, in which a trusted third-party product was abused to reach downstream users, although the exact delivery method has not been established.

How the loader hides inside legitimate software

The chain abuses a .NET start-up mechanism known as AppDomainManager injection. In simple terms, a legitimate endpoint-management program is used as the launchpad, and its configuration file is manipulated so that malicious code runs inside a trusted process instead of standing out as a separate program. Further layers, including encoded XAML files and .NET components, are then unpacked in stages. One stage is designed to bypass Windows anti-malware scanning, while a later stage runs inside dllhost.exe, gathers system information, and contacts a command-and-control server.

What is, and is not, known

Kaspersky's telemetry identified a single victim in Asia, and the activity has not been attributed to a known threat group. It is also not clear whether sensitive information was stolen. The country was not named, although reporting notes signs pointing to the bespoke Windows 10 China Government Edition. That identification remains an inference, not a confirmed attribution. For defenders, the practical lesson is narrower: custom government builds still need the same scrutiny as mainstream systems, because a trusted update path and a legitimate application can become the cover for a multi-stage intrusion.