BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A newly discovered UEFI bootkit named BlackX has been deployed in a targeted espionage campaign in early 2026, raising significant concerns within the cybersecurity community. The malware operates at the lowest levels of device firmware.

The bootkit leverages the legacy Baton Drop vulnerability to successfully bypass Secure Boot protections. By doing so, it forces the system to load a malicious driver before the operating system even boots up.

Once active, this malicious driver is designed to actively interfere with security solutions, specifically targeting products from major vendors like Kaspersky and Avast to blind the system's defenses.

This sophisticated attack highlights the persistent danger of firmware-level threats and demonstrates how older vulnerabilities continue to be weaponized in modern espionage operations.

For cybersecurity professionals globally, including the tech community in emerging markets, this incident emphasizes the critical need for robust firmware security, constant UEFI monitoring, and proactive vulnerability patching.