The poisoned update existed for ten minutes. Then the file went back to normal
2026-10-31Security
Mandiant published its AOMEI investigation on 15 October. The attacker never parked malware on the update server: they edited a config file for five to ten minutes at a time, served whoever polled, and reverted it.
