<p>Malware propagation is a major security threat to the Internet of Things (IoT). By exploiting the clustered structure of IoT, malware can realize rapid intra-cluster spread and large-scale inter-cluster transmission. However, significant gaps exist in the understanding of cross- and intra-cluster propagation mechanisms, and in the development of efficient patching strategies. To solve the above problems, we propose a clustered malware propagation and layered patch distribution model, considering both intra- and inter-cluster malware transmission processes as well as centralized and decentralized patch distribution modes. We theoretically derive the critical transmission threshold of malware and the critical immunization threshold of devices, and find that the structure of the most compromised clusters has a significant impact on them. We further investigate the optimal patching strength allocation for the two defense modes. Results verify the value of their combined application, and decentralized defense should be emphasized to contain large-scale malware propagation. Additionally, source cluster protection should be prioritized in the early stage to control the outward spread, while other clusters should be targeted later for prevention. Finally, we validate the theoretical thresholds and stepwise propagation pattern in the networks constructed using a typical clustering protocol, and clarify the impact of network time-varying characteristics: the shorter update period accelerates propagation, but this can raise the probability of devices receiving direct patching, thus significantly enhancing malware defense efficacy. Our findings provide theoretical support for designing efficient cross-cluster collaborative defense mechanisms in the clustered IoT.</p>