United StatesKaspersky found BlackX infecting fully patched Windows machines.
Bootkits can survive a Windows reinstall when the infected boot partition remains intact.
Microsoft’s 2023 and 2024 patches left the old signing certificate trusted until administrators manually revoke it.
Microsoft held back enforcement because early revocation could leave millions of devices unbootable.
Microsoft’s guidance does not say whether home Windows users need to take the extra step.
How each outlet framed it
- Ars Technica leans critical
- blames Microsoft's unclear Secure Boot guidance, not unpatched systems, for BlackX infecting fully updated Windows machines
Sources: Ars Technica