Compromised eScan update infrastructure distributes malicious software to customers

On 20 January 2026, unauthorized access to MicroWorld Technologies' eScan regional update infrastructure placed an unauthorized file in the legitimate software-distribution path and delivered it to a subset of customers during an approximately two-hour window. MicroWorld confirmed the update-infrastructure compromise and temporarily disrupted update services while isolating and rebuilding affected infrastructure. Morphisec's independent analysis characterized the delivered file as a multi-stage malicious payload that established persistence, modified eScan configuration and blocked further updates on compromised endpoints. MicroWorld disputed aspects of Morphisec's characterization and scope but confirmed the unauthorized distribution event.