Kasperky warns popular Daemon Tools app backdoored by hackers to target specific victims
- Attackers poisoned DAEMON Tools downloads with malware, infecting thousands worldwide
- The campaign deployed an infostealer first, followed by a selective backdoor on targeted machines
- Researchers suspect Chinese actors, noting the attack’s precision against government and industry systems
DAEMON Tools, a popular program used to create and use virtual drives on a computer, was poisoned to deliver dangerous backdoor to thousands of users, experts have warned.
Security researchers Kaspersky published a new report outlining how someone broke into the website hosting DAEMON Tools around April 8, 2026. They added multiple new versions of the software, 12.5.0.2421 through 12.5.0.2434 - for DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe binaries.
When installed, these versions deployed multiple malwarevariants. First, the victim gets infected with a basic infostealer that grabs system data (hostname, MAC address, running processes, installed software, and system locale), and relays it to the attackers. Then, based on the information returned, the malware moves...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
