{"id":209097,"date":"2026-02-02T00:47:00","date_gmt":"2026-02-02T05:47:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/02\/escan-antivirus-update-servers-compromised-to-deliver-multi-stage-malware\/"},"modified":"2026-02-02T08:00:10","modified_gmt":"2026-02-02T13:00:10","slug":"escan-antivirus-update-servers-compromised-to-deliver-multi-stage-malware","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/02\/escan-antivirus-update-servers-compromised-to-deliver-multi-stage-malware\/","title":{"rendered":"eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware"},"content":{"rendered":"

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/02\/escan-antivirus-update-servers.html<\/a><\/p>\n

Publish Date: 2026-02-02 00:47:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

The update infrastructure for eScan antivirus, a security solution developed by Indian cybersecurity company MicroWorld Technologies, has been compromised by unknown attackers to deliver a persistent downloader to enterprise and consumer systems.<\/p>\n

“Malicious updates were distributed through eScan’s legitimate update infrastructure, resulting in the deployment of multi-stage malware to enterprise and consumer endpoints globally,” Morphisec researcher Michael Gorelik said.<\/p>\n

MicroWorld Technologies has revealed that it detected unauthorized access to its infrastructure and immediately isolated the impacted update servers, which remained offline for over eight hours. It has also released a patch that reverts the changes introduced as part of the malicious update. Impacted organizations are recommended to contact MicroWorld Technologies to obtain the fix.<\/p>\n

It also pinned the attack as resulting from unauthorized access to one of its regional update server configurations, which enabled the threat actors to distribute a “corrupt” update to customers during a “limited timeframe” of about two hours on January 20, 2026.<\/p>\n

“eScan experienced a temporary update service disruption starting January 20, 2026, affecting a subset of customers whose systems automatically download updates during a specific timeframe, from a specific update cluster,” the company said in an advisory issued on January 22, 2026. <\/p>\n

\"Cybersecurity\"<\/p>\n

“The issue resulted from unauthorized access to the regional update server infrastructure. The incident has been identified and resolved. Comprehensive remediation is available that addresses all observed scenarios.”<\/p>\n

Morphisec, which identified the incident on January 20, 2026, said the malicious payload interferes with the regular functionality of the product, effectively preventing automatic remediation. This specifically involves delivering a malicious “Reload.exe” file that’s designed to drop a downloader, which contains functionality to establish persistence, block remote…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware https:\/\/thehackernews.com\/2026\/02\/escan-antivirus-update-servers.html Publish Date: 2026-02-02 00:47:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":209098,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg2_pLOtIyNONJPvqUhPq0AJ_UsM-8YXPWRQCdP_QmlX6I4vGJrWcWgmpAa3lBiFaBOt6rEKgFt6q4yWhb-Nuu2sUVhvgyx2RZsAmyjXZXTvhaFr21qbyAFqobpiqlceg-jN0-tjwDMS62yu4byJBydGXo_qpw6yHtczD_cBEdJjvesHfZocuJSvTS9w2lR\/s1700-e365\/escan.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32],"class_list":["post-209097","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209097"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=209097"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209097\/revisions"}],"predecessor-version":[{"id":209099,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209097\/revisions\/209099"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/209098"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=209097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=209097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=209097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}