Hackers have compromised AOMEI's update servers to distribute malware through a built-in promotional feature in the company's backup software. The attack targeted users by tampering with configuration files that control how the software fetches content from the vendor's infrastructure.
The intruders only modified the configuration files for a short period before restoring them to their original state. This stealthy approach was likely intended to hide the attack and avoid detection by both users and security tools monitoring the software's behavior.
Because the malware was delivered through AOMEI's own update channel, the incident represents a supply-chain risk for anyone running the affected backup product. The brief window of tampering suggests the attackers moved quickly, but the full scope of affected users has not been disclosed in the available report.