Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

According to a report by BleepingComputer, attackers have compromised the update infrastructure for the cPGuard web security suite. The threat actors exploited the autoupdate mechanism to distribute a backdoor and a data-stealing script to cPGuard customers. The compromise affects the update channel globally, meaning existing installations that automatically applied updates may have received and executed the malicious payloads. The report indicates that the attackers leveraged the trusted update process to deliver the malicious code, potentially resulting in unauthorized access and data exfiltration for affected users. As of the report date, cPGuard has not issued an official advisory detailing the scope of the compromise, the specific exploitation methodology, or the remediation steps. Security analysts recommend that cPGuard users monitor official channels for revocation of compromised update channels and the issuance of clean, signed updates. Verifying update integrity and applying any official patches as soon as they are released are advised. The full extent of the impact, including the number of affected customers and the specific data stolen, remains pending official confirmation.