They change an application before it gets to the user, for example in its source code, its update system or its download. MITRE ATT&CK lists it as an Initial Access technique.
How it works
MITRE says attackers can manipulate application software before the final user receives it. This can happen by changing source code, by tampering with the update or distribution mechanism, or by swapping compiled releases for modified versions. A November 2026 case hit a server security suite through its update channel, covered in our cPGuard update compromise alert.
The target can be narrow or broad. Some attackers aim at a chosen set of victims. Others reach a wide group and act only against selected victims later.
Because the software comes from a known vendor, the change often passes the checks that people and security tools apply to strangers. Our page on the supply chain attack explains the wider idea. For an intrusion that reached a vendor’s build and signing systems, see the BO Team supply chain attack.
A real example
MITRE ATT&CK lists SUNSPOT, GoldenSpy and CCBkdr as using this technique, and describes the 3CX and SolarWinds compromises as campaigns that used it. A 2026 case of tampered update files is described in our AOMEI Backupper incident page. A more recent case is the LiteLLM October 2026 release compromise, in which LiteLLM says its own release pipeline was used to publish a malicious version 1.107.0. In October 2026 OVHcloud said release files of its OVHcloud CLI on GitHub were replaced through a compromised developer account, and StepSecurity tied the swapped files to the loader of the GlassWorm malware.
Seen in incidents
- Incident AOMEI Backupper installer supply chain compromise Between April and July 2026, attackers briefly tampered with the update files of the AOMEI Backupper installer, so that the backup program fetched and ran a backdoor. April to July 2026 · Telecommunications
- Incident LiteLLM 1.107.0 Release Compromise (October 2026) On 21 October 2026 a malicious LiteLLM 1.107.0 was published to PyPI and to the project's Docker image tags. 21 October 2026 · Technology and software supply chain
- Incident SolarWinds Orion supply chain compromise The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March and June 2020. December 2020 · Technology and software supply chain
How to detect
-
Installers and updaters that write programs
MITRE suggests linking an installer or updater that replaces program files with what happens next, such as scripts, shells or unsigned libraries starting on first run.
-
Connections to hosts you did not approve
Watch for software that contacts update hosts outside your approved list shortly after it installs or updates.
-
Signature and notarization problems
Check logs for failed or missing code signature checks when an update is applied.
How to defend
-
Keep software updated and pruned
MITRE advises a patch management process that also checks for unused, unmaintained or previously vulnerable software and unneeded features and files.
-
Scan for known weaknesses
Keep watching vulnerability sources and use automatic and manual code review tools, as MITRE advises.
-
Know your update sources
Keep a list of the hosts each product is allowed to fetch updates from, so a new host stands out.
