In 2023, malware tracked as BlackLotus became the first publicly documented in the wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry wide chain of trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational. Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first...
