Supply Chain Compromise Affecting Daemon Tools Distribution Channel

A supply chain compromise involving Daemon Tools installers distributed via the official vendor website has been identified. The attackers used valid code-signing certificates to make the trojanized installers appear legitimate and bypass security controls. These malicious packages deploy a backdoor that performs system reconnaissance, environment verification, and communicates with attacker-controlled command-and-control infrastructure. The compromise leverages trusted software delivery mechanisms to evade detection, establish persistent access, and enable remote command execution. Organizations should block related malicious infrastructure, hunt for suspicious Daemon Tools installations and network activity, verify software integrity, and implement application allowlisting. Monitoring for unusual certificate usage in software deployment is also advised. No patch or official fix information is available, and no known exploits in the wild have been reported.

• Supply Chain Attack on arrayref: Significant Overlap with DPRK CampaignsMalware2026-08-20
• Popular Rust Crates Compromised in Build-Time Supply Chain AttackMalware2026-08-20
• Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participantsMalware2026-08-21
• Backdoor delivered through software updatesMalware2026-08-19
• Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticsCampaign2026-10-27