Short-Lived Hijack of AOMEI Backupper Update Service Exposes Users to Backdoor Malware

Security researchers have uncovered a brief but sophisticated intrusion of AOMEI Technology's official update infrastructure for its Backupper backup software, during which malicious code was delivered to unsuspecting Windows users. The intrusion, which unfolded in a series of five‑ to ten‑minute windows between May and July 2026, altered the files that the program retrieves from the vendor's own servers, effectively turning a routine update check into a delivery mechanism for a backdoor.

AOMEI Backupper is a widely used utility for creating system images and file‑level backups on Windows platforms, catering to both home users and small‑business environments. Because backup tools often run with elevated privileges and have deep access to system data, they represent attractive targets for attackers seeking persistent footholds in compromised networks.

According to the analysis, the attackers replaced the legitimate update payload with a malicious variant only during narrowly defined intervals. Any instance of Backupper that initiated an update check within those intervals automatically downloaded and executed the tampered package, granting the adversaries remote access capabilities. The brief duration of each hijack made detection difficult, as standard monitoring tools typically aggregate logs over longer periods.

The incident adds to a growing list of supply‑chain compromises that have plagued the software ecosystem in recent years, from high‑profile incidents such as the SolarWinds breach to more localized attacks on niche utilities. By exploiting trusted distribution channels, threat actors can bypass many conventional security controls, highlighting the need for stronger code‑signing verification and real‑time integrity checks on update servers.

AOMEI has responded by revoking the compromised binaries, restoring the integrity of its update repository, and collaborating with independent security firms to audit its deployment pipeline. The company advises users to verify digital signatures on downloaded files, apply any available patches, and consider temporarily disabling automatic updates until the remediation is confirmed. Analysts suggest that the episode will prompt broader industry discussions on securing software update mechanisms, especially for tools that operate with high privileges.