India

MicroWorld Technologies confirmed a breach of its eScan antivirus update infrastructure, allowing attackers to deliver a malicious downloader to enterprise and consumer systems. Unauthorized access was detected, leading to the isolation of affected update servers for over eight hours. A patch was released to revert the changes made by the malicious update, and impacted organizations were advised to contact MicroWorld for assistance. The attack occurred on January 20, 2026, when a compromised update was distributed within a two-hour window. The malicious payload, introduced through a rogue "Reload.exe" file, hindered eScan's functionality, blocked updates, and contacted an external server for additional payloads. This rogue executable was signed with a fake digital signature and employed techniques to evade detection. It also included an AMSI bypass capability and assessed whether to deliver further payloads based on the presence of security solutions. The malicious "CONSCTLX.exe" altered the last update time of eScan to create a false sense of normalcy. The attack primarily targeted machines in India, Bangladesh, Sri Lanka, and the Philippines, highlighting the rarity and seriousness of supply chain attacks through antivirus products.