The backdoor was on the update server for five minutes, which is why the alerts were dismissed as false positives
2026-10-17Security
Attackers swapped two unsigned text files on AOMEI's update servers in windows of five to ten minutes. Anyone checking afterwards found clean files, so the analysts who went to look concluded their own detections were wrong.