Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors

A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026. Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update. The operation did not rely on a software flaw or require users to open a suspicious file. Instead, the attackers changed two configuration files on AOMEI’s servers, redirecting downloads…