Hackers Breach AOMEI Update Infrastructure, Slip Malware Through Built‑In Promotion Feature

Security researchers have confirmed that threat actors infiltrated the update servers of AOMEI, a Chinese software firm known for its backup and disk cloning tools, and used a built‑in promotional module to deliver malicious code to unsuspecting users.

The intrusion targeted the automatic update channel of AOMEI Backupper, a program that millions of home and small‑business users rely on to protect critical data. The software includes a feature that periodically displays promotional offers; attackers hijacked this mechanism to insert a payload that masqueraded as a legitimate update.

According to the investigation, the perpetrators gained access to the server that hosts configuration files for the update service. They altered these files just long enough to point the client software to a malicious executable, then reverted the changes to their original state. This brief window of tampering was designed to evade detection by standard integrity checks and to leave minimal forensic traces on the server.

The malicious code was first spotted by security analysts monitoring network traffic from AOMEI Backupper installations. Unusual download URLs and unexpected binary signatures triggered deeper analysis, which revealed that the payload was a trojan capable of downloading additional modules and exfiltrating files. The researchers traced the download source back to the compromised AOMEI server, confirming a supply‑chain style attack.

While the exact number of affected installations is still unknown, the attack window appears to have been limited to a few hours. AOMEI has issued a statement acknowledging the breach, confirming that the altered configuration files have been restored, and that a clean update package has been pushed to all clients. The company also advises users to verify the integrity of their installations and to run a full system scan with reputable security software.

This incident adds to a growing list of supply‑chain compromises that have targeted trusted software distributors, from major operating‑system updates to niche utilities. By exploiting the trust relationship between a vendor and its user base, attackers can bypass many traditional defenses that focus on endpoint protection alone.

Industry experts recommend that organizations adopt multi‑layered verification, such as code signing checks and out‑of‑band hash validation, especially for software that performs critical system functions like backups. Vendors, meanwhile, are being urged to tighten server access controls, implement immutable configuration management, and monitor for rapid file changes that could indicate tampering.

As the investigation continues, cybersecurity firms are monitoring for any follow‑up activity that might indicate the same actors are attempting to leverage the same technique against other software update channels. The AOMEI breach serves as a reminder that even well‑intentioned convenience features can become vectors for sophisticated malware if the underlying infrastructure is not adequately protected.