Banned Kaspersky swapped itself for UltraAV on US PCs while users slept

In late September 2024 US customers of Kaspersky antivirus discovered their software had been automatically replaced with a new product, UltraAV, from Pango — some saying they had no idea this would happen. 'Woke up to Kasperky [sic] completely gone from my system with Ultra AV and Ultra VPN freshly installed (not by me, just automatically while I slept),' one Reddit user wrote; others reported the same. A former Kaspersky reseller said he was left 'annoyed' by the automatic replacement.

The swap followed the US government's unprecedented ban on Kaspersky sales, announced in June 2024 and effective 20 July, with limited security updates allowed until 29 September. Kaspersky had offloaded its US customers to Pango, and confirmed that on 19 September a software update 'facilitating the transition' was pushed so users 'would not experience a gap in protection upon Kaspersky's exit from the market'. UltraAV's site told Windows customers 'no action is required'.

Pango said all customers were notified in early September, but could not point TechCrunch to where users were explicitly told their software would be force-replaced. Customer Avi Fleischer said Kaspersky 'should've given me the option to accept UltraAV or not... They should NEVER push software onto someone's computer without explicit permission.' Rob Joyce, former NSA cybersecurity director, wrote that users were 'migrated' automatically, adding Kaspersky 'had total control of your machine'. No financial figures are reported.

Customer anger and distrust — resellers 'annoyed', users ripping UltraAV out — and a former NSA director citing it as proof of the risk in Kaspersky's machine access

Deep system access is a one-way trust: using it to uninstall one vendor and install another without asking breaks it.

Some customers got emails about a 'transition' but not the fact their antivirus would be replaced wholesale overnight.

The forced swap validated the government's core worry — that the software could do anything to a machine — in public.

A rushed handover before the 29 September deadline left little room for an opt-in flow, so the vendor chose silence.

Software with deep system access shouldn't be swapped without asking — a migration done silently reads like the next breach.

As of 23 September 2024 Kaspersky had not commented beyond its forum post; Pango maintained customers were notified; affected users who objected had to remove UltraAV themselves. Kaspersky's US updates were set to end 29 September.