eScan confirms update server breached to push malicious update

MicroWorld's eScan update infrastructure was breached on January 20, 2026, allowing a malicious update (modified Reload.exe leading to a CONSCTLX.exe backdoor/downloader) to be distributed to customers for a short window; Morphisec published technical findings (persistence via scheduled tasks, HOSTS modifications, C2 domains) and eScan has isolated and rebuilt impacted infrastructure, rotated credentials, and issued remediation guidance.