Attackers tampered with AOMEI Backupper update servers to deliver a backdoor

Attackers changed files fetched by AOMEI Backupper from the vendor’s update servers during several five-to-ten-minute windows between May and July 2026. Windows systems that checked for updates during those windows downloaded and ran a backdoor. AOMEI reported fixing its servers, but that does not remove backdoors from machines already affected.