In January 2026, a critical supply chain compromise was uncovered impacting MicroWorld Technologies’ eScan antivirus product. Attackers abused eScan’s legitimate update infrastructure to distribute a trojanized update, resulting in the installation of multi-stage malware on systems worldwide. The attack was particularly severe because it disabled eScan’s own update and remediation mechanisms, forcing affected organizations to rely on manual recovery.
Severity: High
Incident Background
On January 20, 2026, Morphisec identified malicious activity originating from an official eScan update. The update channel normally trusted to deliver security fixes was weaponized to push a compromised binary to both enterprise and consumer endpoints globally. Because the payload was digitally signed with a legitimate eScan certificate, it bypassed traditional trust checks and security controls.
Attack Chain And Technical Details
The compromise followed a multi-stage attack chain:
- Stage 1 – Trojanized Update
- The legitimate Reload.exe (32-bit) updater was replaced with a malicious version.
- This binary was signed using an authentic eScan code-signing certificate, increasing its success rate.
- Its primary role was to establish initial execution and deploy the next stage.
- Stage 2 – Downloader and Defense Evasion
- The malware created scheduled tasks under Windows\Defrag\ for persistence.
- It executed PowerShell payloads, modified the hosts file, and altered eScan registry settings to block legitimate update servers.
- These actions ensured that eScan could not self-update or remediate the infection.
- The malware then connected to external command-and-control (C2) infrastructure to retrieve additional payloads.
- Stage 3 – Persistent Downloader
- A 64-bit component (CONSCTLX.exe) was deployed to maintain long-term access.
- Persistence was reinforced through registry keys with randomly generated GUIDs containing encoded PowerShell data. This stage enabled continued attacker control and potential follow-on activity.
Recommendations
- Enterprises and consumers using eScan Antivirus should perform scans for known malicious files particularly: Trojanized Reload.exe and Persistent downloader CONSCTLX.exe
- Inspect scheduled tasks under C:\Windows\Defrag\ for anomalous or non-standard task names.
- Hunt for registry persistence via GUID-named keys under HKLM\Software\ containing encoded PowerShell payloads.
- Contact MicroWorld Technologies (eScan) directly to obtain the official manual patch.
- Validate and restore:
Hosts file entries (remove blocks on eScan update servers)
eScan registry and configuration settings - Reset credentials for any users or service accounts that logged into or were used on affected systems.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/ab5979dd1041fa4967733a3179e6049ddae38a2f7885697165d15fbb8b67900d/iocs
Source:
- https://www.morphisec.com/blog/critical-escan-threat-bulletin/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.