Official DAEMON Tools Lite installers spread backdoors; clean release replaces compromised software
Official, signed DAEMON Tools Lite installers carried malware from 8 April. Disc Soft says free Lite 12.5.1 was affected. Uninstall it, run a full antivirus scan, then install clean version 12.6.0.2445 or later if needed.
If you installed free DAEMON Tools Lite 12.5.1 during the affected period beginning 8 April, uninstall it and run a full scan with trusted antivirus software. If you still need it, install version 12.6.0.2445 or later from the official website; ask your IT team to check any affected work computer.
- DAEMON Tools Litefixed in 12.6.0.2445 and later
What’s happening
Attackers compromised DAEMON Tools’ software supply chain, distributing digitally signed Windows installers through its official website from 8 April 2026. Kaspersky disclosed the attack on 5 May after observing several thousand infection attempts across more than 100 countries and territories, mostly affecting home users. The malware collected computer details, accepted remote commands and could install further malware; about a dozen selected organisational machines received additional payloads. Kaspersky identified compromised builds 12.5.0.2421–12.5.0.2434, while Disc Soft’s statement identifies the affected release as free DAEMON Tools Lite 12.5.1 and excludes paid Lite, Pro and Ultra. Clean build 12.6.0.2445 was released on 5 May and independently confirmed by Kaspersky on 6 May. The vendor says distribution is contained, but affected computers still require scanning. As at 3 November, the reviewed sources provide no final root-cause finding, named attacker or confirmation that every infected computer has been cleaned.
- What
- Poisoned software
- Affects
- DAEMON Tools Lite for Windows (free edition)
- Affected
- DAEMON Tools Lite 12.5.1 (free edition), as identified by Disc Soft
- Fixed in
- DAEMON Tools Lite 12.6.0.2445
- Since
- 8 Apr 2026
- Closed
- 8 May 2026
Timeline
- Update
Kaspersky expanded its response guidance with detection rules for organisations using its SIEM security-monitoring system.
- Update
Kaspersky confirmed that release 12.6.0.2445 no longer contained the malicious behaviour described in its report.
- Vendor revised
Disc Soft confirmed interference in its build environment and said the affected product was free DAEMON Tools Lite 12.5.1. It removed that version, declared distribution contained and said paid Lite, Pro and Ultra were unaffected.
- New fixFixed
Disc Soft released clean DAEMON Tools Lite 12.6, build 12.6.0.2445. The company subsequently said its response took less than 12 hours after notification at approximately 07:00 GMT.
- Made public
Kaspersky disclosed several thousand infection attempts across more than 100 countries and territories. It identified compromised builds 12.5.0.2421–12.5.0.2434 and additional malware deployed to about a dozen selected machines.
- UpdateNo fix yet
Compromised, digitally signed DAEMON Tools installers began circulating through the official website, according to Kaspersky’s later investigation.
Sources
- Security Incident Affecting DAEMON Tools Lite: What We Know So FarDisc Soft · 6 May 2026
- DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026Kaspersky · 8 May 2026
- Kaspersky identifies supply chain attack on official Daemon Tools website distributing backdoor malwareKaspersky · 5 May 2026
- DAEMON Tools trojanized in supply-chain attack to deploy backdoorBleepingComputer · 5 May 2026
- DAEMON Tools devs confirm breach, release malware-free versionBleepingComputer · 6 May 2026