Malicious Code Delivered Through AOMEI Backup Tool After Server Breach

Security researchers have confirmed that threat actors gained unauthorized access to AOMEI Technology's update infrastructure and used it to push malicious payloads to users of the company's backup software, exploiting a built‑in promotional component to conceal their activity.

The intrusion appears to have been limited to a brief window during which the attackers altered configuration files on the update servers. By swapping legitimate update metadata with references to a concealed malware downloader, they were able to inject the code into the software's automatic update process before restoring the original files to avoid detection.

AOMEI's backup suite includes an optional “promo” feature that displays third‑party advertisements or offers during installation or update cycles. The compromised update servers redirected this feature to a malicious executable that, once run, installed a trojan capable of harvesting system credentials and communicating with remote command‑and‑control servers.

The malicious updates were distributed for a short period, estimated at less than 24 hours, before the tampered configuration was reverted. Users who installed the compromised version during that window may have unwittingly introduced the malware onto their machines. Security firms monitoring the activity flagged the anomalous network traffic and reported the findings to both AOMEI and the broader security community.

AOMEI has issued an emergency statement acknowledging the breach, confirming that the affected software version has been withdrawn, and urging customers to update to the latest release, which contains a clean build and additional integrity checks. The company also pledged to conduct a forensic review of its server environment and to enhance its code‑signing and distribution safeguards.

The incident underscores the growing risk of supply‑chain attacks that target trusted software distributors. By compromising a legitimate update channel, attackers can bypass many traditional defenses that rely on the reputation of the source. Analysts advise organizations to adopt layered verification methods, such as hash validation and multi‑factor authentication for server access, to mitigate similar threats in the future.