PKFail
PKFail is a Secure Boot bypass threat associated with UEFI firmware misconfiguration. The provided content states that PKFail involved devices shipped with untrusted test certificates, which enabled Secure Boot bypasses. It is cited by NSA and CISA alongside BlackLotus and BootHole as an example of bootkit-related risk arising from improperly managed Secure Boot variables and trust stores. The malware/threat is relevant to enterprise environments using outdated, default, disabled, or otherwise misconfigured Secure Boot settings, including improper Platform Key (PK), Key Exchange Key (KEK), allowed database (DB), and revocation database (DBX) configurations. The content does not attribute PKFail to a specific threat actor, infection vector, or industry targeting, but places it in the context of firmware-level threats that can undermine boot integrity and persistence protections when systems are provisioned with untrusted certificates or permissive Secure Boot configurations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PKFail refers to a class of vulnerabilities where devices are shipped with untrusted test certificates, allowing attackers to bypass UEFI Secure Boot and install persistent malware.
PKFail is a class of malware or attack technique that targets misconfigurations or failures in UEFI Secure Boot, allowing attackers to bypass firmware-level security and gain persistent, stealthy access to systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.