For: people and organisations that use AOMEI Backupper, the Windows backup software, at home or at work, and IT staff who manage PCs where it is installed. This article is based on AOMEI's official statement and does not cover attack techniques, the malware's contents or indicators of compromise (IoCs).
Developing: this article will be updated as the organisation publishes more
- Who is affected
people and organisations that use AOMEI Backupper, the Windows backup software, at home or at work, and IT staff who manage PCs where it is installed.
- Confirmed so farSee the table ↓
- Tampering with the update server's configuration files
- Three identified windows
- Release of 8.5.1
1 more
- Server hardening and migration
Listed as possibly affected
- Devices that received the changed configuration
- Windows authentication-related information
- Not yet confirmed
- Number of affected users or devices
- Affected versions and editions
- Whether there were tampering windows beyond the three identified
1 more
- Whether Windows authentication information was actually exposed
- What to do nowSee the steps ↓
- Run AOMEI Security Scanner, from the official statement page
- Update to AOMEI Backupper 8.5.1
- Update your security software and run a full scan
2 more
- Change the Windows or domain account password
- If something is found, ask the company and do not restore recent backups blindly
- Where to verify (source)All sources ↓
- AOMEI, "Statement on Ephemeral Tampering with the AOMEI Backupper Update Server" (published October 19, 2026, last updated October 30)
- Last checked
- As of October 31, 2026
Follow-up plans and what we checked
The statement says: "The findings and recommendations may be updated as the investigation progresses." On October 31 the page showed "Last Updated on October 30, 2026".
What AOMEI Backupper users should do today
Run AOMEI Security Scanner, from the official statement page
The company's first step is to scan the PC with AOMEI Security Scanner, which checks for currently known indicators of this incident. It says updating to 8.5.1 does not replace this check.
Open the company's statement yourself (link under Sources) and use the download link there, not a link from an email or a search ad. The statement publishes the scanner's digital signature name and SHA-256 value, and says they may change when the tool is updated, so compare against the page on the day you download.
Update to AOMEI Backupper 8.5.1
The company released 8.5.1 on October 19, 2026 and says it addresses the security issues found so far and adds safeguards. If you use an earlier version, update as soon as possible from the company's download page (www.aomeitech.com/download.html). The version is shown in the program's "About" screen.
The company has turned off the in-app update mechanisms involved, so do not rely on the app's own update prompt.
Update your security software and run a full scan
The company says other risks on the device cannot be ruled out even after the first two steps. It recommends updating the installed security software and running a scan. If the result is not conclusive, it suggests a second scan with a reputable free scanner installed from its official source (the statement names one).
Change the Windows or domain account password
The company says some devices may have been at risk of exposing Windows authentication-related information, while noting this exposure has not been confirmed. It recommends changing the password of the Windows account or domain account used on the PC, and on other devices that use the same password. Changing only the Windows Hello PIN is not enough.
If the scan found something, change the password from a different, clean device. A password typed on an infected PC can be captured again.
If something is found, ask the company and do not restore recent backups blindly
The company says it will provide technical support, including remote help, through the dedicated contact address on its statement page. If anything was detected, check backups made after May 28, 2026 before restoring them, because a backup of an infected system can bring the problem back (see: backup and recovery essentials).
What happened (from AOMEI's statement)
The following is based on AOMEI's statement published on October 19, 2026 and last updated on October 30, which cites an investigation report by a security company's threat intelligence team (published October 16).
April–July 2026
According to the investigation report, configuration files on the AOMEI Backupper update server are changed for a few minutes at a time and then reverted.May 28, 05:40–05:50 UTC
First identified window (10 minutes).July 16, 08:33–08:39 UTC
Second identified window (6 minutes).July 20, 10:35–10:40 UTC
Third identified window (5 minutes).By July 29
After being notified, AOMEI hardens the update servers. The researchers report no further related activity within their monitoring.August 5
The update service moves to a new server with additional security controls.October 19
AOMEI publishes its statement and releases AOMEI Backupper 8.5.1.October 30
Last update of the statement.
Times above are UTC. In Japan time the windows were May 28, 14:40–14:50; July 16, 17:33–17:39; and July 20, 19:35–19:40.
Most of the time
The update server returned the normal configuration
During a window
A PC that checked for updates could receive a changed configuration that pointed to malicious files
Afterwards
The file was put back, so checking the server later showed nothing wrong
Fixing the server does not clean a PC that already received something. That is why the company asks users to scan their own devices.
- What happened
- Short-burst tampering with configuration files on the AOMEI Backupper update server, April to July 2026, each change lasting about five to ten minutes
- Possible effect
- During those windows, the altered configuration could direct the software to download malicious files
- Windows identified
- May 28, July 16 and July 20, 2026 (UTC). The scope of affected users is still being investigated
- Software measures
- Affected in-app update mechanisms turned off; signature checking and encryption added for remote configuration files; the client rejects files that fail the signature check
- Server measures
- The old update server taken offline; update service moved to a new server; software updates separated from marketing notifications in 8.5.1; monitoring strengthened
- Asked of users
- Scan with AOMEI Security Scanner, update to 8.5.1, scan with security software, change the Windows or domain account password
What is known and what is not
The state as of October 31, 2026. When there is a follow-up, the status column will be updated.
| Item | What the statement says | Status |
|---|---|---|
| Tampering with the update server's configuration files | Repeated short-burst changes, April to July 2026 | Confirmed (investigation report cited by the company) |
| Three identified windows | May 28, July 16, July 20, 2026 (UTC) | Confirmed (company) |
| Devices that received the changed configuration | May have been at risk | Possible (company) |
| Windows authentication-related information | Some devices may have been at risk of exposing it; not confirmed | Possible (company) |
| Release of 8.5.1 | October 19, 2026 | Confirmed (company) |
| Server hardening and migration | By July 29; new server on August 5 | Confirmed (company) |
| Affected versions and editions | Not listed. Users of versions before 8.5.1 are asked to update | Not stated |
| Number of affected users or devices | Not stated; still being assessed | Under investigation |
| Windows beyond the three identified | The investigation report says there were probably more that were not observed | Under investigation |
| The company's other products | The investigation report says the company's remote desktop product uses the same update flow; the company's statement mentions only AOMEI Backupper | Not stated |
| Backup images and files | Not mentioned | Not stated |
How to read this: 'not stated' is not 'not affected'
The company has not said which versions were affected, and it asks every user to take the four steps. Not finding your version in a list does not mean your PC was out of scope, because there is no list yet.
What a tampered update can lead to
In general, malicious files delivered through a software update can do the following. This does not mean all of it happened here.
- Run with the same rights as the updater, which for backup software is often administrator-level
- Leave something behind that starts again after a reboot, so removing the original program is not enough
- Give someone remote access to the PC, and from there to shared folders and other PCs on the same network
- Capture passwords or authentication data, which is why the company asks for a Windows password change
The investigation report describes the files delivered in this campaign as including downloaders and backdoors that give remote access. A similar case on the web side: the Rank Math PRO 3.0.123 malware, where a paid plugin update shipped with malware for about 11 hours.
For IT staff: checks across many PCs
These are defensive checks drawn from the company's statement and the investigation report. They do not assess AOMEI's handling.
- Find every PC with AOMEI Backupper. Use your software inventory or endpoint management. Note the version and whether the PC was on during the three windows.
- Look back over April to July 2026, not just today. The report notes that fixing the server does not clean endpoints that already downloaded something, and that checking the vendor's server now shows clean files. Review scheduled tasks and new programs started by the updater on those PCs.
- Block outbound file-sharing traffic (SMB and WebDAV) to the internet at the firewall. The report recommends this. It also limits a common way Windows authentication data is sent outside.
- Reset domain passwords for users of affected PCs, in line with the company's advice, and check sign-in logs for those accounts.
Sources (public records)
The facts in this article are based on the public information below. The malware's behaviour in detail and IoC values are not reproduced here; check them in the official statement and report.
- AOMEI, "Statement on Ephemeral Tampering with the AOMEI Backupper Update Server" (published October 19, 2026, last updated October 30) — aomeitech.com
- AOMEI, download page for AOMEI Backupper — aomeitech.com
- A security company's threat intelligence team, investigation report cited in the company's statement (October 16, 2026) — cloud.google.com
Update history
2026-10-31: First version. Based on AOMEI's statement (published October 19, last updated October 30) and the investigation report it cites. This article will be updated when the company publishes more.
Read next
- Same type of incident: Rank Math PRO 3.0.123 shipped with malware
- Backups that do not bring the problem back: Backup and recovery essentials
- Terms: What a backdoor is / What malware is
- Other 2026 incidents: Data breaches and cyberattacks of 2026