In January 2026, a routine antivirus update became the attack. Dream identified in national environments in Southeast Asia, a highly concerning compromise in which malicious software updates were delivered via MicroWorld Technologies’ eScan antivirus’s legitimate update infrastructure. In continuation of:

- The MORPHISEC article (referencing the revision dated January 29th, 2026).

- The MicroWorld Technologies confirmation regarding their eScan antivirus, as referenced in the BLEEPINGCOMPUTER, and HELPNETSECURITY articles.

Dream’s cyber platform uncovered additional troubling details, including DNS listings and evidence of a targeted, skillful hunting approach. It is Dream’s assessment that what was supposed to protect endpoints instead was utilized as the delivery mechanism for a covert attack, affecting both consumer and enterprise environments.
The campaign, internally named Verglas, quietly replaced an eScan component with a trojanized version, initiating a multi-stage infection chain:

1. Once installed, the malware granted remote access to infected systems and deliberately worked to lock itself in.
2. The malware modified Windows host files and eScan registry settings to block future updates, disrupt remediation, and prevent the antivirus from correcting the compromise.

Dream’s platform identified and investigated the campaign autonomously in the affected national environment, detecting the attack in the wild as it unfolded. By correlating signals across update behavior, system changes, and infrastructure activity, Dream reconstructed the full infection chain and exposed how a trusted security product had been weaponized.

The credibility of the attack represented its most perilous aspect. The malicious update was linked to an eScan certificate; however, it was found to be invalid in certain verification scenarios. This may indicate potential misuse or tampering; nonetheless, the certificate's exact status cannot be definitively ascertained.

The attack peaked around January 20, 2026, spreading through a channel explicitly trusted to deliver security updates. Organizations using the affected update mechanism should assume potential compromise. Immediate isolation of suspected endpoints is critical, alongside preservation of forensic evidence.

A complete incident response assessment is strongly recommended to determine the scope of exposure, identify any additional affected systems or credentials, and guide containment and remediation. As a precaution, organizations should review and reset potentially exposed credentials and ensure recovery is performed only from trusted backups or known-good system images.