A hacker circulated malware undetected for nearly a month by hijacking downloads for DAEMON Tools, a once-popular software program to run virtual CD and DVD drive files.
DAEMON Tools confirmed the incident today after antivirus provider Kaspersky observed “several thousands of infection attempts” involving the virtual mounting software. “At the time of writing this article, the supply chain attack is still active,” Kaspersky wrote on Tuesday.
Kaspersky discovered a hacker had been delivering malicious versions of DAEMON Tools Lite starting on April 8 through the official vendor site at daemon-tools.cc. Affected versions range from 12.5.0.2421 to 12.5.0.2434. The installers came with three .exe programs that have been rigged to deliver a backdoor to a Windows PC. (DAEMON Tools Lite has only been on Windows 10 or later starting with version 12.4.)
Following Kaspersky’s report, DAEMON Tools said it “identified unauthorized interference within our infrastructure, [and] as a result, certain installation packages were impacted within our build environment and were released in a compromised state.”
This suggests the hacker infiltrated the IT systems of DAEMON Tools’ developer, Latvian software provider AVB Disc Soft. Kaspersky noted that the malicious versions of the program were digitally signed by the developer and discovered signs that a Chinese-speaking hacker is behind the attack.
In response, DAEMON Tools said it removed all the potentially compromised files and started vetting all its internal processes. A new, malware-free version of DAEMON Tools Lite, 12.6, was also released on Tuesday. “We would also like to emphasize that this incident did not affect other products developed by Disc Soft Limited. DAEMON Tools Ultra, DAEMON Tools Pro, and all other products remain fully operational and safe to use,” the company says.
It’s unclear how the hacker infiltrated Disc Soft’s systems. For now, DAEMON Tools says: “Our investigation is ongoing as we continue to analyze the root cause and full scope of the incident. At this stage, we are not attributing the incident to any specific third party. We are carefully reviewing all components of our infrastructure to ensure a complete and accurate understanding of what occurred.”
The attack was effective enough to spread malware to users and organizations based in more than 100 countries, according to Kaspersky’s antivirus data. The majority of the victims were based in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. (In 2024, the US banned Kaspersky software.)
“However, out of all the machines infected, we have observed further-stage payloads being deployed to only a dozen of them,” Kaspersky added. “These machines that received further payloads belonged to retail, scientific, government, and manufacturing organizations—and this indicates that the supply chain attack has a targeted manner.”
For affected users, DAEMON TOOLs is urging victims to uninstall the Trojanized program and “run a full system scan using trusted security or antivirus software.” Kaspersky noted its own antivirus can detect and flag the malware. Users can also consider the nuclear option: reinstalling Windows.
The DAEMON Tools hack is the latest software “supply chain attack,” in which tampered software packages spread a malicious download to numerous users. Last month, a hacker also briefly hijacked downloads for PC-monitoring tools CPU-Z and HWMonitor.
About Our Expert
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
-
AST SpaceMobile Eyes June Launch of Three BlueBirds After Satellite Loss
-
These Smart Glasses Pack in Samsung OLED Microdisplays to Play Video
-
Anthropic Wants in on Elon Musk’s Space Data Centers, Colossus Supercompute
-
Researcher Finds Microsoft Edge Stored Passwords Load in Plaintext
-
TCL CSOT’s 0.01Hz Screen To Squeeze More Battery Life Out of Your Laptop
-
More from Michael Kan
