DAEMON Tools infected with malware: what happened and how to protect yourself

Informatec Digital » Resources » DAEMON Tools infected with malware: what happened and how to protect yourself

The news has come as a shock: official versions of DAEMON Tools Lite have been distributing malware to thousands of computers in over a hundred countries through a supply chain attack that has caught users and companies completely off guard. We're not talking about pirated copies or scam websites, but rather installers downloaded directly from the developer's legitimate site, digitally signed and, seemingly, entirely legitimate.

This incident is particularly concerning because it involves a long-established and highly popular tool. DAEMON Tools has been a leading software for mounting ISO images and creating virtual drives for over 15 years , boasting millions of monthly users from both individuals and organizations. The fact that such well-known software has been used as a vehicle for a backdoor and a data-stealing Trojan demonstrates the extent to which supply chain attacks have become one of the biggest challenges in modern cybersecurity.

What exactly happened to DAEMON Tools?

Kaspersky researchers have uncovered a widespread campaign in which legitimate DAEMON Tools Lite installers were modified to include a malicious payload. The attack reportedly began on April 8, 2026, and was still ongoing when the first reports surfaced, indicating that the attackers managed to remain undetected for several weeks.

Related articles:

Podman, KVM and containers: a practical guide to secure virtualization

In this case, no fake websites or pirated copies of the program were used . The Trojanized files were hosted on DAEMON Tools' own distribution infrastructure and were signed with a valid digital certificate from AVB Disc Soft, the company responsible for developing the software. To any user, and to many security systems, these installers appeared completely trustworthy.

According to published analyses, this was a carefully planned supply chain attack in which the criminals managed to inject malicious code into several executables included in compromised versions of the program. These modified binaries ran automatically upon system startup, establishing silent communication with command and control servers under the attackers' control.

The campaign resulted in thousands of infection attempts in over 100 countries . Most victims were home users, but approximately 10% of malicious installations were detected on systems belonging to organizations. These included high-value sectors such as public administration, scientific research, manufacturing, and retail.

The attack wasn't just about indiscriminate infection ; it was targeted at specific individuals. The first phase acted as a filter, gathering system data, and based on that information, the attackers decided whether it was worthwhile to deploy a much more sophisticated second stage with advanced espionage and remote control capabilities.

Affected versions and compromised components

Reports agree that the problem is limited to a specific range of DAEMON Tools Lite versions. The affected versions of the software are between 12.5.0.2421 and 12.5.0.2434, inclusive. Anyone who has installed one of these builds, especially after April 8, 2026, should be aware of a real risk of compromise.

Within that range, the attackers modified three key program executables , which are installed in the DAEMON Tools root directory and are automatically loaded with the system or the software itself. The binaries identified as malicious are:

• DTHelper.exe
• DiscSoftBusServiceLite.exe
• DTShellHlp.exe

These Trojanized executables behaved as loaders: upon startup, they established a connection with a domain controlled by the attackers and were able to execute commands via cmd.exe to download and launch other pieces of malware. Technical analyses mention, for example, the use of files such as envchk.exe , cdg.exe , and cdg.tmp , which functioned as additional components within the infection chain.

The telemetry collected by security solutions allowed this activity to be linked to a targeted global operation . Although the volume of infection attempts was high, the second phase was deployed against a very small number of carefully selected victims, reinforcing the idea that this was not just a mass campaign, but a targeted attack against entities with sensitive information or critical infrastructure.

To contain the incident, AVB Disc Soft released version 12.6.0.2445 of DAEMON Tools Lite , which has been verified as clean by various security firms. This update removes the compromised executables and introduces legitimate components without malicious code, making it currently the only safe version for those who need to continue using the program.

How the attack works: from the first to the second phase

The behavior of malware associated with DAEMON Tools follows a typical two-phase attack pattern , very common in targeted operations. First, a lightweight reconnaissance component is deployed, and only in certain cases are more complex tools deployed to take control of the system.

In the first stage, the malicious code embedded in the modified binaries runs persistently every time Windows starts. From that point on, the compromised computer sends a request to a command and control server using a domain that appears legitimate, such as env-check.daemontools.cc, in order to receive further instructions.

The "first course" of the attack is a basic information-gathering module . This component extracts and sends attackers data such as the MAC address, hostname, DNS domain, list of running processes, installed software, and system regional and language settings. With all this information, cybercriminals create a detailed profile of the infected machine.

In most of the detected infections, the situation didn't progress beyond this initial level of espionage . The systems only received the data collector, without any more powerful modules being downloaded. Even so, it's a serious intrusion because it allows attackers to identify environments that are attractive targets for subsequent attacks and to leak potentially sensitive information about the victim's infrastructure.

In a very small subset of cases, mostly associated with government agencies, research centers, and industrial and retail companies in countries like Russia, Belarus, or Thailand, the command server responded by sending a second payload: a minimalist backdoor with much more advanced remote control capabilities.

This second-stage backdoor can download and execute new payloads, launch shell commands, and run code directly in memory with virtually no trace on disk, making detection extremely difficult. From there, the system is at the mercy of attackers, who can pivot to other machines, exfiltrate documents, or deploy additional espionage tools.

In the most critical cases, the deployment of an implant called QUIC RAT has been observed . This remote access Trojan supports various communication protocols with the command and control server and is capable of injecting malicious code into legitimate processes such as notepad.exe or conhost.exe. This type of injection technique helps to camouflage malicious activity among trusted operating system processes.

Magnitude of the incident and affected countries

The data collected so far shows a large-scale attack, but with highly selective use of the most damaging capabilities . Since the beginning of April, several thousand attempts have been recorded to install additional malicious payloads through compromised DAEMON Tools Lite installers.

Most of the affected computers belong to home users, which makes sense given that DAEMON Tools has been used for years as the standard tool for mounting ISO images and creating virtual CD, DVD, or Blu-ray drives. The impact is spread across approximately one hundred countries and territories, with a particularly high concentration of victims in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.

However, the researchers emphasize that only a dozen devices were selected for the second phase of the attack , in which the lightweight backdoor and the QUIC-based RAT were deployed. These included systems belonging to government agencies, scientific institutions, manufacturing companies, and retail infrastructure, which is more consistent with a targeted operation than a simple, opportunistic, mass attack.

This pattern suggests that the attackers used DAEMON Tools as a broad entry point , but that the true objective was to spy on or compromise specific networks of high strategic value. The remaining victims largely served as background noise and cover to better conceal the activity directed at those priority targets.

Another striking detail is the presence of malware components written in Chinese . Some analysts suggest this could indicate a possible origin for the attack's developers, although it's also entirely possible that it's a diversionary tactic to divert attention to specific countries or groups and complicate attribution.

From the average user's perspective, the biggest problem is that this entire attack has relied on the enormous trust generated by such widespread software . Millions of people have assumed for years that if they download the installer from the official website and it has a valid digital signature, there's nothing to worry about. This case demonstrates that even these signs of trust are not foolproof.

DAEMON Tools, a committed classic in its prime

To understand the scope of the problem, it's important to remember that DAEMON Tools is not a fringe application , but rather a well-established tool in the Windows ecosystem. For decades, it has been used to mount disk images in formats such as ISO, IMG, UDF, BIN, and NRG, which contain the complete structure of CDs, DVDs, and even hard drives and SSDs.

During the golden age of optical media, DAEMON Tools became practically a de facto standard for those who needed to work with disk images on a daily basis. Although lighter or open-source alternatives exist today—such as WinCDEmu in the Windows environment—the program still has a huge user base, both in home and business environments.

The developers of the utility indicate that the software maintains more than three million monthly users , a figure that explains why a campaign of this type can so quickly reach thousands of computers worldwide. The greater the popularity of a tool, the more attractive it is for attackers to infiltrate its distribution chain.

In this context, the fact that all the malicious installers were signed with a valid certificate is especially concerning. In many cases, both users and security platforms themselves take the digital signature as an indicator of authenticity, assuming that the binary file has not been tampered with. Here, however, the attackers managed to slip their code in before the signature was obtained or reuse the company's legitimate signing infrastructure.

The DAEMON Tools incident adds to a growing list of software supply chain attacks detected since the beginning of the year. Security reports mention similar cases affecting solutions like eScan in January, Notepad++ in February, and CPU-Z in April, highlighting a clear trend: instead of directly targeting individual users, cybercriminals prefer to compromise a central link and let the software distribution itself do the rest.

Specific risks for users and organizations

Beyond the media hype, what's truly important is what can happen on a computer where an infected version of DAEMON Tools has been installed . The risks vary depending on how far the infection chain has progressed, but even in less severe scenarios, the impact is significant.

In the initial phase, the main impact is the silent theft of system information . Data such as MAC address, hostname, locale, or list of installed software may seem insignificant, but in the hands of an attacker, they allow them to profile the network, identify vulnerable versions of other programs, and prepare much more sophisticated subsequent attacks.

If the system is selected for the second phase, the danger increases significantly. The lightweight backdoor allows for the execution of remote commands and the downloading of additional files , opening the door to a whole host of threats: from the theft of credentials and sensitive documents to the installation of ransomware or the use of the computer as an entry point to compromise the entire corporate network.

With the deployment of QUIC RAT, attackers gain virtually complete remote access to the device . They can inject code into legitimate processes, bypass some security controls, move laterally across the network, and maintain persistence for extended periods without raising suspicion. In the hands of a well-resourced actor, this type of tool is perfect for industrial espionage campaigns or for gaining prolonged access to critical infrastructure.

In organizations with stringent security requirements, an intrusion through common software like DAEMON Tools is particularly problematic. Many work environments assume that widely known, digitally signed utilities are secure by default, so monitoring their behavior can be more lax than with unknown or recently released tools.

Furthermore, this type of incident erodes overall trust in the software distribution chain . If a signed official installer is no longer sufficient guarantee, companies are forced to strengthen their internal validation, monitoring, and early response processes, which entails additional investments of time and resources.

How to know if you are vulnerable and what to do if you use DAEMON Tools

In such a scenario, the first logical question is obvious: Do I have an affected version installed on my computer? The basic check involves reviewing the version number of DAEMON Tools Lite. If it falls between 12.5.0.2421 and 12.5.0.2434, and was installed or updated on or after April 8, 2026, there is ample reason to be concerned.

To reduce risks, experts recommend a series of clear steps. First, immediately uninstall any Lite version within the compromised range and, if you wish to continue using the application, migrate to version 12.6.0.2445 or higher, which has been confirmed as free of the detected malicious modifications.

Next, it is essential to perform a thorough system analysis using a trusted security solution . Leading security suites already include specific detections for the manipulated binaries and payloads associated with this campaign, so a full scan can help locate traces of the malware, even if the original installers have been removed.

In corporate environments, the measures must be even stricter. Organizations must isolate endpoints where DAEMON Tools has been detected as compromised , review logs for anomalous activity since the beginning of April, and verify the integrity of signed executables on their systems. Monitoring network traffic for connections to suspicious domains associated with the campaign is also recommended.

Finally, both at home and at work, it's advisable to carefully examine any strange or recently added processes , as well as any unusual execution from temporary folders or uncommon directories. Although backdoors and QUIC RATs attempt to operate stealthily, in many cases they leave small clues that, with proper monitoring, can be uncovered.

The DAEMON Tools debacle demonstrates that simply focusing on the installer's origin is no longer sufficient . Validating digital signatures remains important, but it has become essential to complement this control with additional layers of security: behavioral analysis, internal whitelists, network segmentation, and strict policies on what software can be deployed in each environment, including secure virtualization practices.

Within the current threat landscape, the attack on DAEMON Tools has become a textbook example of how legitimate, well-established software can be used as a Trojan horse to compromise systems en masse and, at the same time, execute highly targeted operations against a small group of high-value victims. For everyday users, the lesson is clear: it's advisable to thoroughly check any recent installation of the program, update immediately, and remain vigilant even if the software theoretically comes from the most official source possible.