For years, countless people have installed DAEMON Tools almost on autopilot to mount ISO images on Windows, trusting that, because it came from the official website and was digitally signed, it was completely reliable software. The problem is that, at the beginning of April, that trust was completely shattered: The legitimate DAEMON Tools Lite installer itself became a vehicle for distributing malware through a sophisticated supply chain attack., detected by Kaspersky's Global Research and Analysis Team (GReAT).
This incident was not a minor scare, nor was it limited to a few unsuspecting people who downloaded the program from pirate websites. We're talking about thousands of computers in over a hundred countries that installed compromised official versions, served from the legitimate DAEMON Tools domain and signed with a valid developer certificate.Furthermore, the attack did not stop at the initial installation of the program; in a small group of hand-picked targets, it deployed advanced backdoors capable of executing commands and taking remote control of the devices.
What is DAEMON Tools and why is this incident so dangerous?
DAEMON Tools is a veteran virtual drive emulation utility for Windows that allows you to mount disk images in formats such as ISO, IMG, BIN, NRG or UDFDuring the CD and DVD era, it was practically a de facto standard, and today it still boasts a huge user base, both for home and professional use. The developers themselves cite over three million active users each month and more than fifteen years of history.
The underlying problem is that these types of tools need low-level access to the operating system This allows them to create virtual drives, manage controllers, and deeply integrate with the storage subsystem. This leads most users to readily accept administrator privileges during installation, assuming the software is trustworthy because it comes from the official website. If the installer is infected, these privileges become a highway for malware to infiltrate the system.
In the specific case of this campaign, The most affected edition has been DAEMON Tools Lite, the free and most widely used version.The company has insisted that the Pro, Ultra and paid editions have not been compromised, but the extent of what happened with Lite is serious enough to set off alarm bells throughout the industry.
Another factor that aggravates the situation is the blind trust that many users, and even some security solutions, place in the digitally signed executables downloaded from official domainsIn theory, this signature guarantees that the file has not been modified and that it comes from the legitimate publisher. In practice, the attackers managed to camouflage malicious code within packages perfectly signed with the AVB Disc Soft certificate, allowing them to fly under the radar for weeks.
This operation adds to a growing list of attacks on the software supply chain that have recently affected utilities as diverse as eScan, Notepad++, and CPU-Z. The DAEMON Tools case demonstrates that even very popular and seemingly harmless tools can become a global attack vector overnight..
The supply chain attack: Trojanized official installers
According to Kaspersky GReAT's analysis, The campaign started in early April 2026, specifically around the 8thFrom that moment on, the official DAEMON Tools domain began distributing modified installers of the Lite application. The user would download the same executable as always, with the expected name, a valid digital signature, and no apparent signs of anything unusual… but the package concealed altered binaries containing malicious code.
Available reports indicate that Compromised versions range from 12.5.0.2421 to 12.5.0.2434Kaspersky has focused particularly on DAEMON Tools Lite 12.5.1 as a especially problematic build. Kaspersky indicates that the threat affects version 12.5.0.2421 and later of the compromised branch, while Disc Soft has confirmed that update 12.6.0.2445, released on May 5, completely removes the malicious components.
The attack vector was not a pirated installer or a dubious download website. Cybercriminals attacked the developer's own supply chainThis involves compromising internal infrastructure, build processes, or distribution systems to inject malicious code before the final executable is signed and published. To the end user, everything appears legitimate: same domain, same publisher, same signature.
In this operation, the attackers manipulated at least three key binaries located in the DAEMON Tools Lite installation directoryThese modified executables are loaded when the system starts or the application is launched. These modified executables have been identified in other third-party analyses as:
- DTHelper.exe
- DiscSoftBusServiceLite.exe
- DTShellHlp.exe
Through them, malicious functionality was deployed with persistence.
What's unsettling is not just the technical trick, but the time that passed before someone noticed. For almost a month, those who downloaded DAEMON Tools Lite from the official website received a Trojanized version with no visible signs of anomaly.The use of digitally signed software distributed from a trusted source allowed the attack to bypass many traditional defenses and highlighted the high level of sophistication of the actor behind the campaign.
How malware distributed with DAEMON Tools works
Once the user runs the committed installer and completes the installation wizard, The system is then prepared to initiate the malicious code on the next boot or when the application is launched.There are no strange windows or obvious messages: everything relies on the trust that Windows has in DAEMON Tools' own services and processes.
When one of the altered binaries comes into play, It communicates silently with a command and control (C2) server. Controlled by the attackers. The infected machine sends an initial request, and from there, the server decides what to do based on the victim's profile. The attack is planned in several phases, and not all machines make it past the initial stage.
In the first phase, the malware acts as recognition and information collection moduleThe data you can extract includes:
- MAC addresses of network interfaces.
- Hostname and DNS domain name.
- List of running processes.
- List of installed programs.
- System language and region settings.
This set of information, although it may sound uncritical when viewed piece by piece, offers a fairly accurate picture of the victim's environment.
Once all this information has been gathered, The malware sends it back to the C2 server for the attackers to assess the target's interest.With this data they can identify whether the equipment belongs to a home user, a corporate network, a public body or a scientific institution, as well as what security solutions might be installed.
If the system proves attractive, the server responds with a second phase: a lightweight backdoor capable of executing shell commands, downloading and launching new malicious payloads, and injecting code directly into memoryThis approach minimizes traces on disk and complicates forensic analysis, by relying heavily on injection into legitimate processes such as notepad.exe or conhost.exe.
In some documented cases, the deployment of a more advanced implant known as QUIC RAT has been detected, a remote access Trojan that It supports various communication protocols with the C2 and allows for highly flexible system controlAlong with QUIC RAT, researchers have also seen previously unseen code injectors and RATs, pointing to an actor with serious offensive capabilities and its own arsenal, far removed from the usual generic malware.
It is important to emphasize that, although Thousands of teams suffered through the first phase of data collectionOnly a dozen or so systems went on to undergo the second phase with the active deployment of advanced backdoors. These systems belonged to governments, scientific institutions, and companies in the retail, manufacturing, and manufacturing sectors, primarily in countries like Russia, Belarus, and Thailand, indicating a manual selection of high-value targets.
Global scope of the attack, attribution and reaction of the parties involved
Telemetry data from various security solutions, with Kaspersky leading the way, shows that The distribution of the committed installer was global, with a presence in more than one hundred countries and territories.Among the most affected are Russia, Brazil, Turkey, Spain, Germany, France, Italy and China, both in the domestic sphere and in corporate environments.
Approximately one 10% of the infected systems belonged to companies and organizationsAlthough DAEMON Tools is more commonly used for personal projects, it still has a place in corporate networks for managing disk images, lab environments, or test equipment. A single corporate PC that installs a Trojanized executable can become an excellent entry point into the entire internal network.
In the most serious cases observed, the attack was clearly targeted. Just over ten teams from organizations in the retail, scientific, government, and manufacturing sectors received additional workloads and were subject to manual actions.The execution of specific commands, lateral movements, and the use of previously unknown code injectors and RATs were all observed. Inconsistencies detected in some commands and the precision in targeting victims reinforce the hypothesis of a human operation, not entirely automated.
Regarding the attribution, Elements written in Chinese have been found within the malicious codeHowever, analysts insist that this is not enough to directly point to a Chinese-speaking actor. Such trademarks can be used as a diversionary tactic or "false flag" to confuse investigators and divert attention to another country or group.
After detecting anomalous activity in its telemetry, Kaspersky quickly notified AVB Disc Soft, the developer of DAEMON Tools, of the incident. From there, The response focused on three fronts: blocking the compromised installers, auditing the vendor's infrastructure, and releasing a clean version of the software.The company removed the Trojanized Lite installer, audited its packages, and released DAEMON Tools Lite version 12.6.0.2445, confirmed by Kaspersky as free of the detected malicious components.
Today, security solutions from Kaspersky and other providers They detect and block both Trojanized installers and additional campaign payloadsEven so, the incident has made it clear that relying solely on digital signatures and official domains is no longer enough to guarantee the security of an application.
Risks for home users and businesses
If you downloaded or updated DAEMON Tools Lite during the affected period, especially any version between 12.5.0.2421 and 12.5.0.2434, it's reasonable to be concerned about the state of your computer. For the home user, the most common risk is having served, at the very least, as a source of information for the attackers.The collected data (MAC address, host, installed programs, region, active processes, etc.) can be used to profile the environment and, although they are not passwords, they are valuable when planning subsequent attacks.
In the worst-case scenario for an average user, If your PC was chosen for the second phase, the attackers will have been able to execute commands, download new malicious files, manipulate information, or use the machine as a pivot for lateral movements within the home network.This includes the risk that other connected devices, NAS, or other equipment may also be compromised, as well as the theft of credentials, tokens, and sensitive data stored or entered from that equipment.
In business environments, the potential impact skyrockets. A single compromised device on a corporate network can provide attackers with a foothold from which to explore internal systems, escalate privileges, and exfiltrate sensitive documentation.If the malware manages to obtain domain credentials, VPN access, or cloud service tokens, its reach can extend far beyond the original machine.
For this reason, various specialists recommend that organizations not only uninstall DAEMON Tools, but also Thoroughly audit your network to locate any affected installations of the Lite version, isolate suspicious computers, and review logs and unusual activity.It is key to look for strange outbound connections, processes that shouldn't be there, remote command execution events, and possible signs of lateral movement.
This type of incident teaches a clear lesson: Security around third-party software and "traditional" tools should be strengthened with least privilege policies, application controls, encrypted backups, and continuous monitoring.Assuming a program is safe "because I've used it my whole life" is no longer a reasonable option.
How to know if you are affected by DAEMON Tools malware
Before you go crazy formatting your computer, it's a good idea to do some basic checks to assess the extent of the problem. The first step is to identify which version of DAEMON Tools Lite you have installed and on what dates you downloaded or updated it..
If DAEMON Tools Lite appears on your PC in a version between 12.5.0.2421 and 12.5.0.2434, or specifically 12.5.1 installed during AprilThe most prudent course of action is to uninstall it without delay. The consensus between DiscSoft and major security firms is that this version branch includes the compromised builds.
Next, it is recommended Check if the typical binaries of the Lite installation exist in the system and check for signs of suspicious behaviorIt's not about deleting files willy-nilly, but about using security tools to detect if any of those executables have been modified or are generating anomalous traffic to the Internet.
In parallel, it is useful to ask whether Have you noticed anything strange about the equipment since April?Unexpected restarts, unexplained network spikes, the appearance of unknown processes, or sporadic warnings from Windows Defender or other antivirus programs. While the absence of symptoms doesn't guarantee a clean system, it does help prioritize the urgency of certain actions, especially in environments where reinstalling everything is costly.
Finally, if you use this PC for sensitive operations (online banking, access to administration panels, corporate VPN, etc.), It is reasonable to assume that the credentials used during the compromise period could have been exposed. and plan an orderly change of passwords and authentication methods, starting with the most critical ones.
Measures to protect your PC after the DAEMON Tools malware attack
Once you're clear on whether you might be affected, it's time to get to work. Expert recommendations combine specific measures related to DAEMON Tools and General security best practices in Windows against malware and similar attacks.
First, if you have a compromised version: Uninstall DAEMON Tools Lite immediately from the Windows applications panelIf you decide to continue using it later, do so only with version 12.6.0.2445 or later downloaded from the official website, verifying that the installer matches the hash or information published by the provider and scanning the file with your anti-malware solution before running it.
The next step is Perform a thorough system analysis with a reliable security solutionMicrosoft Defender is integrated into Windows 10 and 11 and offers free anti-malware protection, updating automatically through Windows Update. You can also enhance protection using specialized tools like Malwarebytes, HitmanPro, or comprehensive suites such as Bitdefender, Kaspersky, or other trusted antivirus programs.
If the equipment has shown clear signs of advanced infection, or if you prefer to play it safe because you use it for critical work, A clean reinstallation of Windows is a perfectly valid optionSome users, upon detecting backdoors related to this campaign, have opted to completely format their system and reinstall applications from scratch, verifying everything with several scanners until they are sure the environment is completely clean.
On the other hand, it is advisable Change the passwords for the most important accounts used from the potentially compromised device.This includes primary email, social media, online banking, cloud service access accounts, and, in corporate environments, domain or VPN credentials. Whenever possible, enable two-step authentication to make it harder for these accounts to be used fraudulently.
Finally, take this opportunity to reinforce a series of native Windows security settings that help curb future threats, whether they come from DAEMON Tools or any other software.
Good security practices in Windows to avoid similar malware
Beyond the specific incident with DAEMON Tools, it is essential to internalize a series of routines that They greatly reduce the chances of falling victim to malware campaigns, backdoors, or data theft.They're not a magic recipe, but together they form a very solid foundation.
The first is to always have an active and up-to-date anti-malware solutionMicrosoft Defender, integrated into Windows, offers more than decent protection and stays up-to-date through Windows Update, especially if you have a Microsoft 365 Personal, Family, or Premium subscription. If you prefer, you can opt for reputable third-party products, but avoid using too many real-time antivirus programs simultaneously, as they can interfere with each other.
Another essential measure is Do not open emails or attachments from unknown senders or that you did not expect to receive.Many viruses travel hidden in email attachments that activate when opened. If you're unsure of the origin of a document or link, it's best to err on the side of caution. This also includes protection against phishing: learning to distinguish fraudulent emails that impersonate banks, payment platforms, or well-known services.
In the browser, it's worth it activate and keep a pop-up blocker enabledPop-ups aren't just annoying; they can also contain malicious scripts or redirect you to dangerous websites. Microsoft Edge has its own built-in blocker enabled by default, and it's best not to disable it lightly, except for very specific and completely trusted sites.
If you use Edge, you should make sure that SmartScreen protection is activeThis feature alerts you when you visit websites reported as malicious or attempt to download potentially dangerous files. Additionally, SmartScreen analyzes the reputation of the applications you're trying to run: when it's an unknown or recently released program, it issues a warning before allowing it to run, which can save you from serious trouble.
Don't forget the importance of maintaining Windows and all your applications up to date with the latest security updatesMicrosoft regularly releases patches that fix vulnerabilities that attackers can exploit. Windows Update does much of the work for you, but it's still a good idea to occasionally check for pending updates, even if it means restarting your computer.
Regarding privacy, all modern browsers offer Settings to control what data the websites you visit can collectRestricting third-party cookies, disabling excessive tracking, or limiting geolocation and camera permissions helps reduce the surface area exposed to threats such as fraud or identity theft.
Another key layer is the User Account Control (UAC)which should remain enabled. Whenever a program is about to make changes that require administrator privileges, User Account Control (UAC) will display a notification asking you to accept or reject the change. Many types of malware exploit silent executions with elevated privileges; if UAC triggers and you haven't requested anything, that alert is a sign that something is amiss.
Windows 10 and 11 also have the function of Tamper ProtectionThis prevents unauthorized applications from modifying system security settings, starting with Microsoft Defender's own configuration. Many malware families attempt to disable the antivirus upon entry to allow them to operate freely, so verifying that this protection is enabled is highly recommended.
Finally, consider restricting the use of risky software or software with a history of adware. There are documented cases of users who, after installing DAEMON Tools Lite, ended up with suspicious components like trolatunt integrated into your browserslogging visited URLs, searches, IPs, and hardware information. Although in some cases the problem was due to accepting optional offers from the installer, the moral of the story is clear: carefully read each step and uncheck anything you don't really need.
Everything that has happened surrounding DAEMON Tools Lite has made it clear that even the most popular and seemingly trustworthy tools can serve as a Trojan horse if someone manages to infiltrate their supply chain. Checking which version you have, uninstalling compromised builds, thoroughly scanning your PC, changing sensitive passwords, and strengthening Windows defenses are essential steps to overcome this incident with minimal damage.But it's also a good opportunity to raise the bar on security in your daily life and never take an application for granted just because "you've always used it."
