eScan antivirus update server distributed malware; manual recovery tool released
Attackers used an eScan update server to deliver malware on 20 January. eScan says affected customers were remediated, but disputes researchers' wider-impact claims. If you used eScan then, ask support to confirm your computer was checked and recovered.
If you used eScan on a Windows computer on 20 January 2026, contact eScan support or your IT provider to confirm whether it was affected and recovered. Ask for the official manual remediation tool if needed; do not assume that automatic updates alone removed the malware.
- eScanno fixed version yet
What’s happening
Attackers accessed part of MicroWorld Technologies' eScan update infrastructure on 20 January 2026 and distributed a rogue file to customers. eScan says exposure was limited to one regional server cluster for about two hours; it did not identify the region or disclose an affected-customer total. Morphisec reported worldwide exposure, while Kaspersky observed related infection attempts on hundreds of personal and organisational computers. Researchers found malware that remained on computers, contacted attacker-controlled servers and interfered with antivirus updates. eScan disputed parts of that analysis and said it found no evidence of data theft, additional malicious downloads or deployed remote-access capabilities. It released a remediation tool, rebuilt affected infrastructure and rotated credentials. Recovery could require manual assistance because normal updates were blocked. In its statement published on 2 February, eScan said all affected customers had been remediated. No later incident-specific resolution update was found in the search through 3 November. No affected-version list or numbered fixed release was published in the sources reviewed.
- What
- Poisoned software
- Affects
- MicroWorld Technologies eScan antivirus for Windows
- Affected
- eScan installations that downloaded updates from the affected regional server cluster during an approximately two-hour window on 20 January 2026; specific versions and region were not disclosed.
- Fixed in
- eScan manual remediation tool, issued with the initial advisory on 21 January 2026 according to eScan; no version number published.
- Since
- 20 Jan 2026
- Closed
- 2 Feb 2026
Timeline
- Vendor revisedFixed
SecurityWeek published eScan's statement that the incident was fully resolved and all affected customers remediated. eScan disputed worldwide impact, declined to disclose customer numbers and said it found no evidence of data theft, additional malicious downloads or deployed remote-access capabilities.
- Update
Kaspersky expanded its analysis, reporting infection attempts on hundreds of personal and organisational computers, mainly in India, Bangladesh, Sri Lanka and the Philippines. Its analysis described persistent malware capable of downloading further malicious software.
- Update
Morphisec published its technical bulletin, describing persistent malware that interfered with antivirus updates and claiming worldwide impact. It warned that compromised computers needed manual remediation.
- Made public
A customer advisory described unauthorised access to one regional update server and warned that affected computers could stop receiving updates. Recovery could require manually running eScan's remediation tool with support assistance.
- New fixFixed
eScan said it issued an initial customer advisory and remediation patch, having detected suspicious activity internally on 20 January.
- UpdateNo fix yet
Attackers placed a rogue file in eScan's update distribution path. eScan said customers downloading from one regional server cluster during an approximately two-hour window were affected.
Sources
- eScan confirms update server breached to push malicious update — includes eScan's statement and advisory extractsBleepingComputer · 28 Jan 2026
- Threat Bulletin: Critical eScan Supply Chain CompromiseMorphisec · 29 Jan 2026
- Supply chain attack on eScan antivirus: detecting and remediating malicious updatesKaspersky · 30 Jan 2026
- AV vendor goes to war with security shop over update server scareThe Register · 29 Jan 2026
- eScan Antivirus Delivers Malware in Supply Chain Attack — updated with eScan's resolution statementSecurityWeek · 2 Feb 2026