Kaspersky reports 'NetamLoader', a .NET loader planted in a government-only Windows 10 build in Asia, with a C2 domain mimicking OpenAI

The Hacker News reported on 1 November that Kaspersky described a multi-stage infection chain targeting a custom Windows 10 build used exclusively by government entities in Asia. A CAB file placed in the Windows Update download directory bundled a malicious resource with legitimate PatchMyPC components, then used AppDomainManager injection, AMSI bypass and anti-forensic deletion before a final stage inside dllhost.exe, sleeping 22–28 hours between contacts with openaigpt4v[.]com. Kaspersky saw a single victim in an undisclosed country; a supply-chain compromise is suspected and no actor has been attributed.