Loading story…
MicroWorld Technologies’ eScan antivirus update infrastructure was compromised to distribute malicious, trojanized updates that deployed multi-stage malware to endpoints globally. Reporting indicates the initial payload replaced a legitimate 32-bit eScan component (Reload.exe) and initiated a chain that dropped additional stages, including a downloader and a 64-bit backdoor (CONSCTLX.exe) enabling broad remote compromise; Morphisec reported detecting and blocking the activity on customer endpoints and provided file-hash IOCs for hunting.
The malware attempted to prevent recovery and conceal activity by tampering with the Windows hosts file and eScan registry/update configuration to block remote updates, meaning automatic remediation may not work on affected systems and organizations may need to contact eScan/MicroWorld for manual remediation. Additional TTPs described include persistence via scheduled tasks (including Windows defragmentation job-spoofing under WindowsDefrag) and registry-based persistence; recommended response actions include hunting for known malicious hashes, reviewing suspicious scheduled tasks and registry keys, blocking identified C2 infrastructure, and revoking trust in the compromised eScan code-signing certificate if applicable in enterprise controls.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-29, Kaspersky published additional analysis showing the malware used a falsely signed Reload.exe, AMSI-bypassing PowerShell, scheduled-task persistence, and follow-on payloads including CONSCTLX.exe. Its telemetry indicated hundreds of infection attempts, primarily in India, Bangladesh, Sri Lanka, and the Philippines.
On 2026-01-28, eScan confirmed that one regional update server had been breached and used to distribute an unauthorized malicious file to a limited subset of customers. The company disputed Morphisec's characterization and timeline, saying the issue was unauthorized access to update infrastructure rather than a product vulnerability.
By 2026-01-28, Morphisec publicly released a threat bulletin describing the supply-chain compromise, malware stages, persistence, HOSTS-file and registry tampering, and C2 infrastructure. The advisory included hashes, certificate details, and guidance to assume compromise on unprotected systems and obtain a manual patch from eScan.
On 2026-01-21, eScan said it published a preliminary advisory and released a remediation patch/update to restore proper updater functionality on affected systems. A narrower customer advisory followed on 2026-01-22.
Morphisec said it identified the malicious eScan update on 2026-01-20 and blocked related activity on its customers' systems. The firm contacted eScan on 2026-01-21 to report the compromise and share findings.
Also on 2026-01-20, MicroWorld Technologies said it detected the incident internally, isolated the affected infrastructure within about an hour, and took the global update system offline for more than eight hours. The company later rebuilt affected systems and rotated credentials.
On 2026-01-20, attackers used unauthorized access to an eScan regional update server to push a malicious update during an approximately two-hour window. The trojanized package replaced Reload.exe and began a multi-stage infection chain on affected endpoints.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
11 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcerescana.com
Open sourcesecurityonline.info
Open sourcego.theregister.com
Open sourcemorphisec.com
Open sourcebleepingcomputer.com
Open sourcemorphisec.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain compromise of the **3CX Desktop App** caused legitimate, signed Windows and macOS clients to distribute malware, an incident tracked as **`CVE-2023-29059`**. Investigations by VMware, Rapid7, Fortinet, and Splunk found that affected Electron-based builds, including Windows versions **18.12.407** and **18.12.416** and several macOS releases, contained a maliciously altered bundled library. On Windows, the attack chain used a sideloaded **`ffmpeg.dll`** to decrypt or load code hidden in **`d3dcompiler_47.dll`**, then contact attacker-controlled infrastructure through GitHub-hosted `.ico` files that concealed command-and-control data. Researchers reported that the malware collected host identifiers such as the **MachineGUID**, reached out to malicious domains and GitHub repositories for second-stage payloads, and ultimately delivered a browser-stealing DLL targeting data from **Chrome, Firefox, Edge, and Brave**. VMware telemetry observed related command-and-control traffic as early as early March, while Fortinet said victim connections were concentrated in Europe and North America. 3CX revoked the certificate for the prior Windows version, said malicious domains and the GitHub repository were taken down, and advised customers to uninstall the desktop client and temporarily use the browser-based **Progressive Web App (PWA)** while defenders hunt for indicators of compromise and block known-bad infrastructure.
Aug 15, 2026
Security researchers linked **SmartApeSG** to an intrusion chain that used a compromised website to serve a fake browser update ZIP, leading victims to execute a malicious JavaScript file. The script retrieved additional payloads from attacker-controlled URLs, including Base64-encoded content that was decoded into a ZIP archive containing **NetSupport RAT** components, after which `client32.exe` was launched on the victim system. The activity was detected during a January 2024 incident when eSentire's BlueSteel PowerShell classifier flagged malicious PowerShell execution. Investigators said the malware established persistence through the Windows `Run` registry key, confirming a full remote-access trojan deployment tied to SmartApeSG. eSentire reported that it isolated the affected host, contained the intrusion, and notified the customer.
Aug 14, 2026
Huntress uncovered a malware operation abusing software signed by **Dragon Boss Solutions LLC** and its legitimate **Advanced Installer** update mechanism to push a multi-stage payload onto Windows systems. The chain reportedly began with `RaceCarTwo.exe` and `Setup.msi` and ended with the PowerShell script `ClockRemoval.ps1`, which executed with **SYSTEM** privileges to kill antivirus processes, disable security services, add Windows Defender exclusions, block AV vendor domains via the hosts file, and maintain persistence through **WMI event subscriptions** and scheduled tasks. Researchers found that update domains including `chromsterabrowser[.]com` and `worldwidewebframework3[.]com` were left unregistered, creating a supply-chain-style takeover risk in which anyone controlling those domains could have delivered arbitrary malware through the trusted updater. Huntress registered and sinkholed the infrastructure before it could be hijacked, then recorded **23,565 unique infected hosts** from **124 countries** contacting the domains within 24 hours, including systems in universities, government agencies, OT networks, schools, healthcare organizations, and multiple Fortune 500 environments; the firm warned the access could have been used to deploy ransomware, infostealers, or other follow-on payloads after endpoint protections were stripped away.
Aug 14, 2026