The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the company says is used by more than 100 million people worldwide. It lets users back up files, copy entire drives, and recover data if something goes wrong with their PC.
AOMEI Backupper update servers hijacked to push malware: Check your PC
About this summary. This is a short excerpt from the description that Malwarebytes Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc
Source attribution: headline and facts are from Malwarebytes Labs (malwarebytes.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Infostealer riding the AI Train
Key Points Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes…
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 119
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain…
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and…
Investigating Ephemeral Supply Chain Tampering
Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the…
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli, which led us to an operation posing as a Web3 accelerator. That operation had spent months…