eScan, the antivirus update that delivers malware: the trusted channel as a risk

Archive: reconstruction written in November 2026

Topic of the month, January 2026 · by cybercoverinsurance

On 20 January 2026 a regional update server of eScan, the antivirus made by Indian company MicroWorld Technologies, distributed a malicious file to customers' computers for about two hours. The file blocked further antivirus updates, installed itself persistently and downloaded other programs. Security firm Morphisec detected it the same day, and Kaspersky counted hundreds of computers hit, mainly in India, Bangladesh, Sri Lanka and the Philippines.

For cyber underwriters the case concerns a company's most trusted channel: the automatic update of its security software. When that channel is compromised, the control meant to protect becomes the way in, and it does so for many customers at the same moment.

What is known

The attack. According to eScan, someone gained unauthorised access to the configuration of a regional update server, and a wrong file was placed in the distribution path for about two hours on 20 January. The company isolated the servers, kept its update infrastructure offline for more than eight hours and published an advisory on 22 January (SecurityWeek).

What the file did. The malicious program replaced a legitimate antivirus file, with a fake digital signature. It modified the HOSTS file to prevent new updates, created scheduled tasks to stay active and contacted an external server to download more code. It checked whether analysis or security tools were present on the computer, and stopped if so. It also wrote a fake update date, so that the product appeared up to date. Kaspersky detected infection attempts on hundreds of computers belonging to individuals and organisations (The Hacker News).

The clean-up. Automatic removal was not possible, because the file blocked updates. Affected customers had to contact eScan to receive a clean-up tool (SecurityWeek).

Competing versions. eScan spoke of a "temporary update service disruption" and a "corrupt" update, disputed the supply chain attack label and said it had found no evidence of data theft. Morphisec and Kaspersky instead describe a deliberate multi-stage infection chain (The Hacker News, SecurityWeek).

What is not known. How the attackers got into the server, who they are, how many customers were hit and what the final goal was have not been made public. eScan said the impact concerned a small subset of customers, without giving numbers.

The trusted channel as the way in

Automatic updates are a privilege. Security software has the highest permissions on a computer and receives updates without anyone checking them. Whoever controls the update channel controls, for a few hours, every computer that receives it.

The control that switches itself off. The malicious file blocked antivirus updates and simulated a successful update (The Hacker News). For the insured, the antivirus appeared active and up to date. A positive answer in the questionnaire does not say whether the control really works.

Two hours are enough. The distribution window was about two hours (SecurityWeek). No internal checking process at the insured could have stopped an update signed by the vendor in so little time. The defence lies in detecting anomalous behaviour after installation.

Aggregation on a security vendor

One vendor, many insureds. An antivirus widespread among a country's small and medium businesses creates a common dependency. The eScan case stayed limited, but the same mechanism applied to a vendor with more customers would produce many claims together.

Portfolio geography. The computers hit were concentrated in South Asia (The Hacker News). For those insuring businesses in a region, the dominant security vendor in the local market is an aggregation data point to collect, like the cloud or business software provider.

The CrowdStrike precedent, in reverse. In July 2024 a faulty CrowdStrike update stopped millions of computers without any attack. eScan shows the malicious version of the same risk: the update channel as a single point that can hit every customer.

Who pays

The affected customer has a claim. For the customer, the infection is a cyber attack in every respect: response, clean-up and verification costs. The insured's cyber policy usually responds without distinguishing whether the attack came by email or from the vendor.

Recourse against the vendor is uncertain. eScan disputes the nature of the attack and its contract terms usually limit liability towards customers. For the insurer paying the claim, recovering from the security vendor is difficult, especially if the vendor is based in another country.

The vendor's communication matters. The gap between eScan's version and the researchers' makes it harder for customers to assess what happened on their computers. A vendor that downplays can delay customers' response and lengthen the claim.

What to bring to renewals

Impact for insurersMedium

An antivirus update server distributed for two hours a malicious program that blocked updates and downloaded more code, hitting hundreds of computers in South Asia.

On the portfolio side, the eScan case suggests collecting the name of insureds' main security vendor, especially among small businesses and in markets where a few local products dominate. A scenario of a malicious update distributed by a widespread vendor is a useful aggregation test, with a short distribution window but a potentially high number of claims.

Sources

• SecurityWeek – timeline, eScan's position and clean-up tool
• The Hacker News – how the malware worked and Kaspersky data