Malware Was Discovered in Daemon Tools Software

| 2026-05-07 09:30 MEDIUM HIGH

JSON

Executive Summary AI-generated

The supply chain attack on Daemon Tools software has been contained, but not before it infected thousands of machines across more than 100 countries. The incident began when threat actors exploited a vulnerability in the application's installer to hide malware, which was then distributed from the main website. As a result, victims were left vulnerable to various types of cyber attacks, including Trojanized versions of popular software and malicious payloads injected into system processes like notepad.exe and conhost.exe. The attack highlights the importance of vigilance when installing new software and the need for organizations to carefully examine machines that had Daemon Tools installed after April 8.

Technical Mitigations AI-generated

• Audited the build and release pipeline to identify and isolate affected systems • Rebuilt and validated installation packages to strengthen internal security controls • Strengthened internal security monitoring systems

Technical Observables

files


                                            
                                                notepad.exe


                                            
                                                conhost.exe

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

Campaign Earlier

Target & Sectors

DACH manufacturing government retail education

Incident Timeline

‎April 8

China-Linked Backdoor Campaign warned users that Daemon Tools software installers distributed from the main website had been Trojanized.

Click on any entity below to view its context and source!

source_region China

The developer urged any user who downloaded the affected version to: Uninstall the application Run a full system scan using trusted security software Download the latest version from the official website A China-Linked Backdoor Campaign Earlier this week, Kaspersky warned that Daemon Tools software installers distributed from the main website had been Trojanized since April 8.

Infosecurity-Magazine

campaign Campaign Earlier

Infosecurity-Magazine

organisation China-Linked Backdoor Campaign

Infosecurity-Magazine

organisation Kaspersky

Infosecurity-Magazine

‎May 5

The Daemon Tools Lite software version 12.6 was released by Disc Soft less than 12 hours after being notified of a supply chain attack.

Click on any entity below to view its context and source!

infrastructure 12.6

Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.

Infosecurity-Magazine

general_metric 12.6 Version

Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.

Infosecurity-Magazine

general_metric 12 hours

Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.

Infosecurity-Magazine

‎May 7

Threat actors used Daemon Tools to target their internal infrastructure.

‎2026/05/07

Threat actors used Daemon Tools to infect victims across multiple countries, including Russia, Brazil, and Turkey.

Click on any entity below to view its context and source!

infrastructure 12.5.1

“The affected version (12.5.1) has been removed and is no longer supported.

Infosecurity-Magazine

infrastructure 12.6.0

The latest version (12.6.0.2445) no longer exhibits the behavior associated with the incident.”

Infosecurity-Magazine

Tactical Metrics

Metrics

infrastructure

‎12.6

Software Version

Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.

Infosecurity-Magazine