Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Attackers compromised the update infrastructure of cPGuard, a web security suite, to distribute a backdoor and a data-stealing script to its users. The attack targeted the autoupdate mechanism, allowing threat actors to push malicious code to systems running cPGuard. This represents a supply chain attack where the security product itself became the delivery vector. The backdoor enables persistent access to compromised systems, while the data-stealing component exfiltrates sensitive information. Users of cPGuard who had automatic updates enabled are potentially affected. The incident highlights the risks of trusting automated update mechanisms without integrity verification.