Kaspersky says the chain strongly suggests a supply-chain attack on a custom Windows build used only by government entities in Asia, but it has not attributed it to a known group and did not observe delivery. The sample surfaced in the first half of 2026.

• Where: a CAB archive in C:\Windows\SoftwareDistribution\Download\ extracted to ...\Download\Install\. Most files were legitimate Patch My PC components and Microsoft-signed assemblies; only Resources.resx carried malicious content.
• How it runs: PatchMyPC-ScriptRunner.exe -updatepackage -applicationid=... loads a side-by-side PatchMyPC-ScriptRunner.exe.config whose appDomainManagerType points at AppFabric's DataCacheFactoryConfiguration in Microsoft.HostIntegration.Connectors. That class reads a crafted fabric.config which instantiates ResXResourceSet over the .resx, unpacking layered XAML and .NET stages. A later plugin runs downloaded XAML in a throwaway AppDomain via a delegate swapped to XamlReader.Parse(), and C2 traffic uses AES-CBC with HMAC-SHA256.
• Detections: HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, Trojan.Script.Agent.*.

Hunt: alert on any *.exe.config that sets appDomainManagerType or appDomainManagerAssembly outside known software, on fabric.config or .resx files next to executables in SoftwareDistribution\Download, and on patch-tool runners launched from that folder. This is a technique writeup, not evidence that Patch My PC itself was compromised.