Vulnerabilities
AOMEI Backupper servers hijacked for minutes at a time to push backdoor
Security researchers discovered a stealthy supply chain attack in which AOMEI Backupper's servers were repeatedly tampered with for five to ten minutes at a time to infect users with a backdoor, Help Net Security reports.
Security researchers have uncovered an unusually stealthy supply chain attack that infected an unknown number of AOMEI Backupper users' computers with a backdoor, according to Help Net Security.
Between April and July 2026, attackers repeatedly altered configuration files on AOMEI's own servers, but only for five to ten minutes at a time before restoring the originals. The tampered files belong to the software's update and promotional pop-up mechanism, which periodically fetches instructions from AOMEI's servers.
This pattern made the campaign difficult to spot. Because the software routinely polls AOMEI's infrastructure, any machine that requested instructions during one of the short tampering windows would have received malicious content through a channel that users and security tools would ordinarily trust. By reverting the files to their original state each time, the attackers left few persistent traces on the server side, complicating detection and forensic analysis.
The report characterizes the operation as an unusually stealthy supply chain compromise, where trust in a vendor's legitimate update infrastructure is abused to distribute malware. The item does not state how the attackers gained access to AOMEI's servers, how many users were ultimately affected, or how the campaign was brought to an end. The activity was observed by security researchers, and further technical details are expected through the source's reporting.
All details here come from Help Net Security.
Source: Help Net Security
