A UEFI bootkit tracked as BlackX infected fully patched Windows machines by bypassing Secure Boot, despite all known Microsoft patches from 2022-2024 being installed. The attack exploits weaknesses in the UEFI chain-of-trust mechanism, allowing malicious code to execute before Windows security defenses are operational.
Background
BlackLotus was the first publicly documented UEFI bootkit to bypass Secure Boot in 2023, marking a significant milestone in firmware-level attacks against Windows systems.
- Source
- Ars Technica
- Published
- Nov 4, 2026 at 12:03 AM
- Score
- 7.0 / 10