Hackers compromise servers used to deliver updates for AOMEI Backupper, altering configuration files for short periods to spread malware. Security researchers report the activity occurs repeatedly between April and July 2026, with changes made for about five to ten minutes before the original files are restored.
The tampered configurations are linked to a built-in update and promotional pop-up mechanism that periodically fetches instructions from AOMEI’s servers. Across sources, the malware delivery is described as stealthy and difficult to detect because the changes are temporary and then rolled back.
Reporting differs mainly in emphasis and completeness. One outlet focuses on the “supply chain” aspect and the specific mechanism within the software used to fetch instructions. Another highlights AOMEI’s lack of customer notification, saying the company confirmed the incidents to a news service in an email. A third stresses the concealment tactic—briefly tampering with configurations and then reverting them—when describing how the attackers spread the malware.
