Kaspersky Uncovers DAEMON Tools Supply Chain Attack

Cybersecurity researchers at Kaspersky have uncovered an ongoing supply chain attack compromising the official website of DAEMON Tools, a Windows utility for creating virtual drives from disk images. Starting April 8, 2026, threat actors tampered with software installers versions 12.5.0.2421 through 12.5.0.2434, injecting malware into three key binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files, digitally signed by developer AVB Disc Soft, have infected thousands of systems across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.

The malware deploys in stages. Upon installation and at system startup, the compromised binaries activate a backdoor that sends HTTP GET requests to a command-and-control server at envcheck.daemontools.cc, a typosquatted domain registered on March 27, 2026. The initial payload acts as an infostealer, collecting system details such as hostname, MAC address, running processes, installed software, and locale before relaying them to attackers for profiling.

Kaspersky observed thousands of such infections among its customers. However, second-stage backdoors, capable of...