BlackX Bootkit Reportedly Infects Fully Patched Windows PCs, Raising Secure Boot Questions

A UEFI bootkit called BlackX has reportedly infected Windows machines that were fully up to date, a result that will worry administrators who assumed routine patching was enough to keep firmware-level malware out. The core question raised by the report is whether Microsoft shares the blame.

UEFI bootkits run before Windows starts, sitting in the firmware boot path where ordinary antivirus software rarely looks. That makes them difficult to detect and remove. Reinstalling the operating system does not touch the malware, and some variants survive a full disk wipe. Secure Boot exists to stop this kind of tampering by allowing only signed boot components to load.

According to the report, the weakness lies partly in how Microsoft has explained what Secure Boot actually covers. When documentation and messaging are vague about which components are protected and which revocation or configuration steps are needed, users and IT teams can believe they are safe while gaps remain. The report frames BlackX as taking advantage of that confusion, not just an unpatched flaw.

Whether that amounts to blame is a judgment call. Closing firmware-level holes depends on work from Microsoft, device makers and motherboard vendors, and the report does not spell out how much of the infection chain each party controls. What it does make clear is that "fully patched" does not always mean "fully protected" at the firmware layer.

For now, the practical advice is to verify rather than assume. Check that Secure Boot is enabled, install the latest firmware updates from the PC or motherboard maker, and confirm that the boot-component revocation list on the device is current. Organizations should audit these settings across their fleets instead of relying on the monthly update cycle alone.