{"id":"daemon-tools-installer-backdoor-may-2026","category":"supply-chain","status":"closed","title":"Official DAEMON Tools Lite installers spread backdoors; clean release replaces compromised software","tldr":"Official, signed DAEMON Tools Lite installers carried malware from 8 April. Disc Soft says free Lite 12.5.1 was affected. Uninstall it, run a full antivirus scan, then install clean version 12.6.0.2445 or later if needed.","summary":"Attackers compromised DAEMON Tools’ software supply chain, distributing digitally signed Windows installers through its official website from 8 April 2026. Kaspersky disclosed the attack on 5 May after observing several thousand infection attempts across more than 100 countries and territories, mostly affecting home users. The malware collected computer details, accepted remote commands and could install further malware; about a dozen selected organisational machines received additional payloads. Kaspersky identified compromised builds 12.5.0.2421–12.5.0.2434, while Disc Soft’s statement identifies the affected release as free DAEMON Tools Lite 12.5.1 and excludes paid Lite, Pro and Ultra. Clean build 12.6.0.2445 was released on 5 May and independently confirmed by Kaspersky on 6 May. The vendor says distribution is contained, but affected computers still require scanning. As at 3 November, the reviewed sources provide no final root-cause finding, named attacker or confirmation that every infected computer has been cleaned.","action":"If you installed free DAEMON Tools Lite 12.5.1 during the affected period beginning 8 April, uninstall it and run a full scan with trusted antivirus software. If you still need it, install version 12.6.0.2445 or later from the official website; ask your IT team to check any affected work computer.","product":"DAEMON Tools Lite for Windows (free edition)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":[],"tags":["disc-soft","daemon-tools","windows","supply-chain","backdoor","malware"],"affected":["DAEMON Tools Lite 12.5.1 (free edition), as identified by Disc Soft"],"fixed":["DAEMON Tools Lite 12.6.0.2445"],"matches":[{"platform":"windows","app":"DAEMON Tools Lite","bundle":"","fixed":"12.6.0.2445"}],"sources":[{"kind":"advisory","title":"Security Incident Affecting DAEMON Tools Lite: What We Know So Far","url":"https://blog.daemon-tools.cc/post/security-incident","by":"Disc Soft","date":"2026-05-06"},{"kind":"research","title":"DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026","url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","by":"Kaspersky","date":"2026-05-08"},{"kind":"post","title":"Kaspersky identifies supply chain attack on official Daemon Tools website distributing backdoor malware","url":"https://www.kaspersky.co.uk/about/press-releases/kaspersky-identifies-supply-chain-attack-on-official-daemon-tools-website-distributing-backdoor-malware","by":"Kaspersky","date":"2026-05-05"},{"kind":"news","title":"DAEMON Tools trojanized in supply-chain attack to deploy backdoor","url":"https://www.bleepingcomputer.com/news/security/daemon-tools-trojanized-in-supply-chain-attack-to-deploy-backdoor/amp/","by":"BleepingComputer","date":"2026-05-05"},{"kind":"news","title":"DAEMON Tools devs confirm breach, release malware-free version","url":"https://www.bleepingcomputer.com/news/security/daemon-tools-devs-confirm-breach-release-malware-free-version/","by":"BleepingComputer","date":"2026-05-06"}],"started":"2026-04-08","closed":"2026-05-08","created":"2026-11-03T20:41:40.382Z","updated":"2026-11-03T20:41:40.382Z","cve_notes":[],"timeline":[{"at":"2026-05-08","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Kaspersky expanded its response guidance with detection rules for organisations using its SIEM security-monitoring system.","url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","by":"Kaspersky","patch":null},{"at":"2026-05-06","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Kaspersky confirmed that release 12.6.0.2445 no longer contained the malicious behaviour described in its report.","url":"https://www.kaspersky.co.uk/about/press-releases/kaspersky-identifies-supply-chain-attack-on-official-daemon-tools-website-distributing-backdoor-malware","by":"Kaspersky","patch":null},{"at":"2026-05-06","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"Disc Soft confirmed interference in its build environment and said the affected product was free DAEMON Tools Lite 12.5.1. It removed that version, declared distribution contained and said paid Lite, Pro and Ultra were unaffected.","url":"https://blog.daemon-tools.cc/post/security-incident","by":"Disc Soft","patch":null},{"at":"2026-05-05","added":"2026-11-03T20:32:12.437Z","kind":"new-fix","text":"Disc Soft released clean DAEMON Tools Lite 12.6, build 12.6.0.2445. The company subsequently said its response took less than 12 hours after notification at approximately 07:00 GMT.","url":"https://blog.daemon-tools.cc/post/security-incident","by":"Disc Soft","patch":"patched"},{"at":"2026-05-05","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Kaspersky disclosed several thousand infection attempts across more than 100 countries and territories. It identified compromised builds 12.5.0.2421–12.5.0.2434 and additional malware deployed to about a dozen selected machines.","url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","by":"Kaspersky","patch":null},{"at":"2026-04-08","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Compromised, digitally signed DAEMON Tools installers began circulating through the official website, according to Kaspersky’s later investigation.","url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","by":"Kaspersky","patch":"none"}],"url":"https://hard.fyi/live/daemon-tools-installer-backdoor-may-2026/","json":"https://hard.fyi/api/live?id=daemon-tools-installer-backdoor-may-2026"}