Supply Chain Compromise of eScan Antivirus Used to Deliver Multi Stage Malware

Du'aine Davis

Observed in the wild

• A supply‑chain compromise of MicroWorld’s eScan antivirus occurred on 20 January, where attackers distributed a malicious update through eScan’s legitimate infrastructure. Both enterprise and consumer users were impacted globally. The tampered update replaced Reload.exe, deployed multi‑stage malware, and disabled eScan’s ability to update, meaning automatic remediation is not possible. Many organisations had to manually contact eScan for fixes.
• The attack delivered a trojanised updater (Reload.exe) that dropped a downloader establishing persistence via Scheduled Tasks, registry keys, and PowerShell. It altered hosts files and eScan registry entries to block further updates. Multiple C2 domains were used for payload retrieval. The malware was signed with a legitimate eScan certificate, indicating deep compromise of their update pipeline. Actor attribution is currently unconfirmed.
• Organisations should search endpoints for the supplied malicious hashes, inspect Windows\Defrag Scheduled Tasks, detect suspicious HKLM\Software GUID registry keys, and check hosts file tampering. Block all identified C2 domains and review update activity from 20 January 2026. As Defender, EDR, and AV updates may be blocked, systems must be manually patched by eScan.

Threat Bulletin: Critical eScan Supply Chain Compromise | Morphisec Blog