GoKawiilBlackX UEFI bootkit bypasses Secure Boot on fully patched Windows systems
Researchers identified a new UEFI bootkit, tracked as BlackX, that infected Windows machines even though they had installed all of Microsoft's patches addressing the 2023 BlackLotus bootkit. Like BlackLotus, BlackX exploits a flaw called 'Baton Drop' in the Windows boot manager to bypass Secure Boot and run malicious code before the operating system and its security defenses fully load.
GoKawiil's interpretation of the reporting above, not reported fact.
The infections raise questions about whether Microsoft's layered patching approach—adding new trusted certificates and revoking old ones—has fully closed the underlying vulnerability, since fully updated systems were still compromised. This suggests attackers may be finding ways around certificate revocation or exploiting gaps in how patches were deployed, which could undermine confidence in Secure Boot as a trust mechanism across the industry.
- BlackX is a newly identified UEFI bootkit capable of infecting fully patched Windows systems.
- It exploits the same 'Baton Drop' logic flaw in the Windows boot manager used by the 2023 BlackLotus bootkit.
- The incident raises questions about whether Microsoft's certificate-based patches have truly closed the Secure Boot bypass.
Source: arstechnica.com, 2026-11-03
Published there as: “UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.