BlackX Bootkit Used an Older Flaw to Bypass Secure Boot, Report Says
BleepingComputer reports that BlackX used the older Baton Drop vulnerability in an early-2026 espionage campaign. It loaded a driver intended to interfere with Kaspersky and Avast security software.
The Short Version
A UEFI bootkit called BlackX exploited the older Baton Drop vulnerability to get past Secure Boot, according to BleepingComputer. The publication says it was deployed in an espionage campaign in early 2026.
Why It Matters
The reported bypass enabled a malicious driver to load. That driver was designed to interfere with security products from Kaspersky and Avast. Its intended function is significant, but the brief account does not establish how often it successfully disabled those protections.
The Bigger Picture
The timing separates two different things: a newly reported bootkit and an older vulnerability used by it. This account should not be read as a claim that Baton Drop was discovered this week, or that the espionage activity only just began.
Likewise, naming two security vendors does not establish that every installation of their products is vulnerable to this campaign.
What to Watch
The supplied excerpt does not identify affected versions, victim numbers or how the attackers first reached a system. It also provides no remediation details. Those specifics would help readers distinguish the reported attack technique from the exposure of a particular computer.
Which details would you need before judging whether a bootkit report affects your own computer?
Connie Brew