By 
MicroWorld Technologies has confirmed that a regional eScan update server was compromised and used to distribute an unauthorized and malicious update to a limited number of customers earlier this month.
According to the company, the file was delivered during a two-hour window on January 20, 2026, affecting users who downloaded updates from a specific regional update cluster. MicroWorld says the impacted infrastructure was quickly isolated and rebuilt, credentials were rotated, and remediation tools were provided to affected customers.
Security firm Morphisec independently published a technical analysis linking malicious activity observed on customer endpoints to updates served from eScan’s infrastructure during the same timeframe. Morphisec reported detecting the activity on January 20 and subsequently notifying eScan. However, MicroWorld disputes claims that Morphisec was the first to discover or report the incident.
eScan stated that it identified the issue internally on January 20 through monitoring and customer reports, isolated the affected systems within hours, and issued a security advisory on January 21. The company also rejected assertions that customers were left uninformed, saying it proactively notified impacted users while remediation was underway.
Update infrastructure compromised
In its advisory, eScan described the incident as an update infrastructure access breach, explaining that unauthorized access to a regional update server configuration allowed a rogue file to be placed in the update distribution path.
The company emphasized that the eScan product itself was not vulnerable and that only customers updating from the affected regional cluster were impacted. All other users were reportedly unaffected.
Customers who installed the malicious update may have experienced:
- Update service failure notifications
- Modified Windows HOSTS files blocking access to eScan update servers
- Altered eScan update configuration files
- Inability to receive new security definition updates
- Update unavailability pop-ups on client systems
Morphisec’s bulletin claims the malicious update included a modified eScan component, Reload.exe, distributed through eScan’s legitimate update mechanism.
Although the file appeared to be signed with eScan’s code-signing certificate, Windows and VirusTotal flagged the signature as invalid. Morphisec reports that the file enabled persistence, executed commands, modified the HOSTS file to block updates, and contacted command-and-control (C2) servers to retrieve additional payloads.
The final payload observed was CONSCTLX.exe, which Morphisec describes as a persistent backdoor and downloader. The malware reportedly established persistence via scheduled tasks with deceptive names such as “CorelDefrag.”
Remediation and recommendations
eScan has released a remediation update designed to automatically detect and correct unauthorized changes, restore proper update functionality, and verify recovery following a standard system restart. Both eScan and Morphisec recommend blocking the identified C2 servers as an additional defensive measure.
