Kaspersky Lab disclosed on May 5, 2026 that the website of Daemon Tools, a widely used disc emulation program, had been compromised with malicious code for more than a month. The infection began with installers released on April 8, 2026 and continued until the company issued a clean version on May 4, 2026.
What happened
According to Kaspersky's Securelist report, the attacker injected malicious payloads into Daemon Tools installers covering versions 12.5.0.2421 through 12.5.0.2434. The compromised installers unpacked several executable files that registered themselves to run at system start up and opened a backdoor that transmitted the computer's MAC address and DNS information to a remote server.
How the malware operated
The backdoor allowed the attacker to execute command line instructions, download additional malicious files, and hijack legitimate Windows processes such as notepad.exe. By leveraging these capabilities, the campaign could expand its reach across private individuals and organizations in more than 100 countries.
Scope of the impact
Daemon Tools reports over 3 million monthly users on its official website. DAEMON Tools official website provides the figure. Analysis of install distribution data estimates that roughly 22.43 percent of those users reside in the United States, translating to about 672,900 American users.
Response from Daemon Tools
The developers were contacted by Kaspersky after the breach was identified. They responded by releasing a corrected installer, version 12.6.0.2445, on May 4, 2026. The new build removes the malicious code and restores the original functionality of the software.
What users should do
All users who installed Daemon Tools between April 8 and May 3, 2026 should uninstall the affected versions and replace them with the clean 12.6.0.2445 release. It is also advisable to run a reputable anti malware scan to ensure no residual components remain.
Why this matters for U.S. consumers
The incident highlights the vulnerability of supply chain pathways that many Americans rely on for everyday computing tasks. With nearly 670,000 U.S. users potentially exposed, the breach underscores the importance of verifying software sources and keeping applications up to date.
Looking ahead
Kaspersky's findings serve as a reminder that threat actors continue to target popular utilities to gain broad access. Security experts recommend that software vendors adopt stricter code signing practices and that users enable automatic updates whenever possible.
