eScan Antivirus Update Servers Compromised in Multi-Stage Malware Attack

The update infrastructure for eScan antivirus, a product of MicroWorld Technologies, was compromised on January 20, 2026. Attackers gained unauthorized access to a regional update server configuration, enabling them to distribute a corrupt update to users for approximately two hours. This breach affected both enterprise and consumer endpoints worldwide, resulting in the deployment of multi-stage malware.

According to Morphisec researcher Michael Gorelik, the malicious updates included a downloader that disrupted the regular functionality of the eScan product, preventing automatic remediation. The malicious payload, identified as “Reload.exe,” was designed to establish persistence on infected systems, block remote updates, and contact an external server for additional payloads.

Kaspersky’s analysis revealed that the rogue “Reload.exe” file replaced a legitimate version, modifying the HOSTS file to prevent further updates. This file executed PowerShell scripts that tampered with the eScan solution, ensuring that the malware remained undetected.

The attack’s impact was significant, with hundreds of machines in regions like India and Bangladesh experiencing infection attempts. The attackers had to understand the eScan update mechanism in detail to exploit it effectively, highlighting the unique nature of deploying malware through a security solution update.

Implications for Users and Organizations

This incident underscores the risks associated with supply chain attacks, particularly in cybersecurity products. Organizations using eScan should monitor their systems closely for any signs of infection and ensure that they apply the latest patches released by MicroWorld Technologies.

Users should be vigilant about the integrity of their antivirus updates and consider implementing additional security measures, such as regular system checks and monitoring for unusual activity. The incident also serves as a reminder of the importance of maintaining robust security practices, including verifying the source of software updates.

As cyber threats evolve, understanding the mechanisms behind such attacks can help users and organizations better prepare for potential risks. Regularly reviewing security configurations and being aware of the latest threats can enhance overall cybersecurity posture.