DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

Back Thehackernews

DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

Thehackernews •[email protected] (The Hacker News) • May 5, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Compromises DAEMON Tools with Malicious Backdoor A supply chain attack has compromised the DAEMON Tools software installers, which began on April 8, 2026. Kaspersky identified that these trojanized installers, signed with legitimate digital certificates, have affected thousands of users globally, with specific targeting of organizations in the retail, scientific, government, and manufacturing sectors. The malware allows attackers to deploy additional payloads on compromised systems, with telemetry indicating infections in over 100 countries. The threat actors are suspected to be Chinese-speaking, and Kaspersky has contacted the software's developer, AVB Disc Soft, who is currently investigating the incident. The attack remains active, with ongoing risks for users who downloaded affected versions (12.5.0.2421 to 12.5.0.2434). Kaspersky's findings have been corroborated by other cybersecurity reports, emphasizing the sophistication and targeted nature of the attack. 16 sources 75

Extracted Entities

Attack Types (2)

Malware Supply Chain Attack

Companies (1)