Attackers have compromised the update infrastructure for the cPGuard web security suite, using it to push a backdoor and a data‑stealing script to unsuspecting users.
cPGuard is a commercial web security solution that protects websites from a range of threats, including malware, phishing and denial‑of‑service attacks. The software is widely deployed by small and medium‑sized businesses to secure their online presence.
According to a report by Bleeping Computer, the attackers hijacked the legitimate update channel used by cPGuard to deliver malicious code. The backdoor provides remote access to compromised systems, while the accompanying script is designed to exfiltrate sensitive data.
The incident was first identified by security researchers who discovered the unauthorized updates being distributed to cPGuard customers. The breach highlights the vulnerability of software update mechanisms when they are not adequately protected.
Security experts warn that any software that relies on an update infrastructure can become a vector for malware if that channel is compromised. Users of cPGuard and similar products are advised to verify the integrity of updates and remain alert to any unusual behaviour in their systems.
<small>Source: Bleeping Computer — read the original story there.</small>
