{"id":"escan-antivirus-malicious-updates-jan-2026","category":"supply-chain","status":"closed","title":"eScan antivirus update server distributed malware; manual recovery tool released","tldr":"Attackers used an eScan update server to deliver malware on 20 January. eScan says affected customers were remediated, but disputes researchers' wider-impact claims. If you used eScan then, ask support to confirm your computer was checked and recovered.","summary":"Attackers accessed part of MicroWorld Technologies' eScan update infrastructure on 20 January 2026 and distributed a rogue file to customers. eScan says exposure was limited to one regional server cluster for about two hours; it did not identify the region or disclose an affected-customer total. Morphisec reported worldwide exposure, while Kaspersky observed related infection attempts on hundreds of personal and organisational computers. Researchers found malware that remained on computers, contacted attacker-controlled servers and interfered with antivirus updates. eScan disputed parts of that analysis and said it found no evidence of data theft, additional malicious downloads or deployed remote-access capabilities. It released a remediation tool, rebuilt affected infrastructure and rotated credentials. Recovery could require manual assistance because normal updates were blocked. In its statement published on 2 February, eScan said all affected customers had been remediated. No later incident-specific resolution update was found in the search through 3 November. No affected-version list or numbered fixed release was published in the sources reviewed.","action":"If you used eScan on a Windows computer on 20 January 2026, contact eScan support or your IT provider to confirm whether it was affected and recovered. Ask for the official manual remediation tool if needed; do not assume that automatic updates alone removed the malware.","product":"MicroWorld Technologies eScan antivirus for Windows","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":[],"tags":["microworld","escan","windows","antivirus","supply-chain","malware"],"affected":["eScan installations that downloaded updates from the affected regional server cluster during an approximately two-hour window on 20 January 2026; specific versions and region were not disclosed."],"fixed":["eScan manual remediation tool, issued with the initial advisory on 21 January 2026 according to eScan; no version number published."],"matches":[{"platform":"windows","app":"eScan","bundle":"","fixed":""}],"sources":[{"kind":"news","title":"eScan confirms update server breached to push malicious update — includes eScan's statement and advisory extracts","url":"https://www.bleepingcomputer.com/news/security/escan-confirms-update-server-breached-to-push-malicious-update/","by":"BleepingComputer","date":"2026-01-28"},{"kind":"research","title":"Threat Bulletin: Critical eScan Supply Chain Compromise","url":"https://www.morphisec.com/blog/critical-escan-threat-bulletin/","by":"Morphisec","date":"2026-01-29"},{"kind":"research","title":"Supply chain attack on eScan antivirus: detecting and remediating malicious updates","url":"https://securelist.com/tr/escan-supply-chain-attack/120040/","by":"Kaspersky","date":"2026-01-30"},{"kind":"news","title":"AV vendor goes to war with security shop over update server scare","url":"https://www.theregister.com/security/2026/01/29/av-vendor-disputes-security-shops-update-server-claims/4712418","by":"The Register","date":"2026-01-29"},{"kind":"news","title":"eScan Antivirus Delivers Malware in Supply Chain Attack — updated with eScan's resolution statement","url":"https://www.securityweek.com/escan-antivirus-delivers-malware-in-supply-chain-attack/","by":"SecurityWeek","date":"2026-02-02"}],"started":"2026-01-20","closed":"2026-02-02","created":"2026-11-03T21:28:20.529Z","updated":"2026-11-03T21:28:20.529Z","cve_notes":[],"timeline":[{"at":"2026-02-02","added":"2026-11-03T21:25:43.261Z","kind":"vendor-revised","text":"SecurityWeek published eScan's statement that the incident was fully resolved and all affected customers remediated. eScan disputed worldwide impact, declined to disclose customer numbers and said it found no evidence of data theft, additional malicious downloads or deployed remote-access capabilities.","url":"https://www.securityweek.com/escan-antivirus-delivers-malware-in-supply-chain-attack/","by":"SecurityWeek","patch":"patched"},{"at":"2026-01-30","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Kaspersky expanded its analysis, reporting infection attempts on hundreds of personal and organisational computers, mainly in India, Bangladesh, Sri Lanka and the Philippines. Its analysis described persistent malware capable of downloading further malicious software.","url":"https://securelist.com/tr/escan-supply-chain-attack/120040/","by":"Kaspersky","patch":null},{"at":"2026-01-29","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Morphisec published its technical bulletin, describing persistent malware that interfered with antivirus updates and claiming worldwide impact. It warned that compromised computers needed manual remediation.","url":"https://www.morphisec.com/blog/critical-escan-threat-bulletin/","by":"Morphisec","patch":null},{"at":"2026-01-22","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"A customer advisory described unauthorised access to one regional update server and warned that affected computers could stop receiving updates. Recovery could require manually running eScan's remediation tool with support assistance.","url":"https://www.theregister.com/security/2026/01/29/av-vendor-disputes-security-shops-update-server-claims/4712418","by":"The Register","patch":null},{"at":"2026-01-21","added":"2026-11-03T21:25:43.261Z","kind":"new-fix","text":"eScan said it issued an initial customer advisory and remediation patch, having detected suspicious activity internally on 20 January.","url":"https://www.theregister.com/security/2026/01/29/av-vendor-disputes-security-shops-update-server-claims/4712418","by":"The Register","patch":"patched"},{"at":"2026-01-20","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Attackers placed a rogue file in eScan's update distribution path. eScan said customers downloading from one regional server cluster during an approximately two-hour window were affected.","url":"https://www.bleepingcomputer.com/news/security/escan-confirms-update-server-breached-to-push-malicious-update/","by":"BleepingComputer","patch":"none"}],"url":"https://hard.fyi/live/escan-antivirus-malicious-updates-jan-2026/","json":"https://hard.fyi/api/live?id=escan-antivirus-malicious-updates-jan-2026"}