Breaches

eScan Antivirus Compromised in Supply Chain Attack, Pushes Malware Through Legitimate Updates

Zero Day Wire

— 2 min read
eScan Antivirus Compromised in Supply Chain Attack, Pushes Malware Through Legitimate Updates

Security firm Morphisec has uncovered a supply chain compromise affecting eScan antivirus software, where attackers distributed malicious updates through the vendor's legitimate update infrastructure.

Discovered on January 20, 2026, the attack targeted both enterprise and consumer editions of the MicroWorld Technologies product, deploying multi-stage malware to endpoints worldwide.

Critical Warning

The malicious payload tampers with eScan's registry, files, and update configuration to prevent future updates and disable antivirus functionality. Automatic remediation is not possible for compromised systems. Affected users must manually contact eScan to obtain the patch.

Attack Chain

The compromise follows a three-stage infection process:

Stage 1: A trojanized version of Reload.exe, a legitimate 32-bit eScan component, is delivered via the update system. The file is signed with eScan's own code signing certificate.

Stage 2: The malware establishes persistence through scheduled tasks, executes PowerShell payloads, and modifies the Windows hosts file to block eScan update servers—preventing the victim from receiving legitimate updates or fixes.

Stage 3: A persistent 64-bit downloader (CONSCTLX.exe) connects to command and control infrastructure for additional payloads.

Incident Timeline

DateEvent
January 20, 2026Malicious update distributed via eScan infrastructure
January 20, 2026Morphisec detects and blocks malicious activity
January 21, 2026Morphisec contacts MicroWorld Technologies
January 21, 2026eScan isolates infrastructure within 1 hour, takes update system offline for 8+ hours

Indicators of Compromise

Trojanized Component (Stage 1):

SHA-256: 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860

Persistent Downloader (Stage 3):

Filename: CONSCTLX.exe
SHA-256: bec369597633eac7cc27a698288e4ae8d12bdd9b01946e73a28e1423b17252b1

C2 Infrastructure:

hxxps[://]vhs[.]delrosal[.]net/i
hxxps[://]tumama[.]hns[.]to
hxxps[://]blackice[.]sol-domain[.]org
hxxps[://]codegiant[.]io/dd/dd/dd[.]git/download/main/middleware[.]ts
504e1a42.host.njalla.net
185.241.208.115

Persistence Mechanisms:

  • Scheduled tasks created under C:\Windows\Defrag\
  • Registry keys under HKLM\Software\<random GUID> containing encoded PowerShell
  • Hosts file modified to block eScan update servers

Recommended Actions

  1. Search for the listed hashes across all endpoints
  2. Review scheduled tasks under Windows\Defrag\ for unexpected entries
  3. Inspect hosts file for entries blocking eScan domains
  4. Block C2 domains at network perimeter
  5. Contact eScan directly to obtain the manual patch—do not wait for automatic updates
  6. Conduct forensic analysis on any system that received updates on January 20, 2026
  7. Reset credentials for accounts accessed from affected systems

eScan Support Contacts

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire