Hackers hijack AOMEI update servers to secretly spread malware

Hackers compromised AOMEI's update servers to distribute malware through a built-in promotional feature in AOMEI's backup software. The attackers tampered with configuration files to push malicious content to users, then restored the files to their original state to conceal the attack. This represents a supply chain attack leveraging trusted software update infrastructure. Users of AOMEI backup products who received updates during the compromise window may have been exposed to malware. The stealthy nature of the attack, with files being restored after tampering, suggests a sophisticated threat actor attempting to minimize detection. The incident highlights risks associated with software update mechanisms and promotional features embedded in applications.