DAEMON Tools official installers trojanized in month-long supply-chain attack
Kaspersky revealed that signed installers downloaded from the official DAEMON Tools website had carried a backdoor since 8 April 2026, infecting thousands of machines in more than 100 countries and delivering follow-on implants, including QUIC RAT, to about a dozen selected targets.
- Victim
- DAEMON Tools (AVB Disc Soft) users