Hackers Abuse DAEMON Tools Distribution Channel to Deliver Malicious Payloads

Gbhackers •Divya • May 5, 2026

A sophisticated supply-chain attack has compromised the official distribution channel for DAEMON Tools, delivering multi-stage malware to users worldwide. Since April 8, 2026, threat actors have distributed trojanized installers signed with legitimate digital certificates to conduct highly targeted cyberespionage operations. Attackers successfully breached the development pipeline of AVB Disc Soft, the creators of the widely […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Compromises DAEMON Tools with Malicious Backdoor A supply chain attack has compromised the DAEMON Tools software installers, which began on April 8, 2026. Kaspersky identified that these trojanized installers, signed with legitimate digital certificates, have affected thousands of users globally, with specific targeting of organizations in the retail, scientific, government, and manufacturing sectors. The malware allows attackers to deploy additional payloads on compromised systems, with telemetry indicating infections in over 100 countries. The threat actors are suspected to be Chinese-speaking, and Kaspersky has contacted the software's developer, AVB Disc Soft, who is currently investigating the incident. The attack remains active, with ongoing risks for users who downloaded affected versions (12.5.0.2421 to 12.5.0.2434). Kaspersky's findings have been corroborated by other cybersecurity reports, emphasizing the sophistication and targeted nature of the attack. 16 sources 75

Extracted Entities

Hackers Abuse DAEMON Tools Distribution Channel to Deliver Malicious Payloads

The full story

Extracted Entities

Attack Types (2)

Companies (2)

MITRE ATT&CK (1)