DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

A supply chain attack compromised DAEMON Tools installers from April 8, 2026, affecting versions 12.5.0.2421 to 12.5.0.2434.

• •Three executables (DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe) were modified to activate malware during system startup.
• •Malware sends HTTP GET requests to env-check.daemontools.cc to download payloads including envchk.exe for system information collection.
• •A shellcode loader (cdg.exe) launches a backdoor supporting multiple C2 protocols (HTTP, UDP, TCP, WSS, QUIC, DNS, HTTP/3).
• •Thousands of infection attempts observed across 100+ countries; only a dozen hosts received follow-on backdoor, indicating targeted operations by Chinese-speaking adversary.

This summary was automatically generated by AI based on the original article and may not be fully accurate.