Executive Summary
A critical supply chain vulnerability (CVE-2026-8398) was disclosed following the discovery that official installation packages for DAEMON Tools Lite — a widely used virtual disc emulation utility for Windows — were replaced with trojanized builds distributed directly from the legitimate vendor website, daemon-tools.cc.
The attack window ran from approximately April 8, 2026 through May 5, 2026. Affected builds span versions 12.5.0.2421 through 12.5.0.2434. Users who downloaded and installed DAEMON Tools Lite during this period may have been silently compromised with malware. The vulnerability carries a CVSS score of 9.8 (Critical).
Users who installed DAEMON Tools Lite during the affected window should treat their systems as compromised and follow the remediation steps below immediately.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-8398 |
| CVSS Score | 9.8 (Critical) |
| Type | Supply Chain Attack / Trojanized Software |
| Attack Vector | Network (official distribution channel) |
| Privileges Required | None (user simply installs software) |
| User Interaction | Required (download and run installer) |
| Patch Available | Yes — clean installers available post-May 5, 2026 |
Affected Versions
| Software | Affected Versions | Exposure Window | Fixed |
|---|---|---|---|
| DAEMON Tools Lite (Windows) | 12.5.0.2421 – 12.5.0.2434 | ~Apr 8 – May 5, 2026 | Post-May 5 builds |
Technical Analysis
Attack Vector
Attackers gained unauthorized access to the vendor's official distribution infrastructure at daemon-tools.cc and replaced the legitimate DAEMON Tools Lite installer packages with malicious versions containing embedded malware. Because the trojanized installers were served from the official website and signed or presented as authentic, users had no reasonable means to detect the substitution during a standard download-and-install workflow.
Infection Chain
1. User navigates to daemon-tools.cc to download DAEMON Tools Lite
2. Server delivers trojanized installer (versions 12.5.0.2421–12.5.0.2434)
3. User executes installer — standard-looking DAEMON Tools UI presented
4. DAEMON Tools installs normally, masking malware payload drop
5. Malware component executes with user or elevated privileges
6. Attacker achieves persistent access to victim systemWhy This Is Particularly Dangerous
Software supply chain attacks via official vendor channels are especially effective because:
- Trust is already established: Users expect official downloads to be clean
- No phishing or social engineering required: The victim initiates the download themselves
- Security tools may not flag it: Installers from known legitimate sites are often whitelisted
- Broad reach: DAEMON Tools Lite is a popular utility with a large install base
Impact Assessment
| Impact Area | Description |
|---|---|
| Malware Infection | Systems running affected versions may be compromised with attacker-controlled malware |
| Data Exfiltration | Depending on payload, credentials, files, or keystrokes may have been stolen |
| Persistent Access | Malware may establish persistence mechanisms that survive reboots |
| Lateral Movement Risk | Compromised endpoints may serve as pivot points into internal networks |
| Credential Theft | Browser credentials, saved passwords, and tokens may be at risk |
Immediate Remediation
Step 1: Identify Affected Installations
Check the installed version of DAEMON Tools Lite:
# PowerShell: check installed version
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*DAEMON*" } | Select-Object Name, Version
# Or check via registry
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*DAEMON*" |
Select-Object DisplayName, DisplayVersion, InstallDateIf the version is between 12.5.0.2421 and 12.5.0.2434 and was installed between April 8 and May 5, 2026, treat the system as compromised.
Step 2: Remove the Affected Installation
# Uninstall DAEMON Tools Lite via PowerShell
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*DAEMON Tools Lite*" }
$app.Uninstall()Or uninstall via Control Panel > Programs > Uninstall a program.
Step 3: Run Full Malware Scan
Use multiple AV/EDR tools as malware signatures may not be immediately available for all solutions:
# Windows Defender full scan
Start-MpScan -ScanType FullScan
# Update definitions first
Update-MpSignatureConsider offline scanning with a bootable rescue environment if the system shows signs of deep compromise.
Step 4: Audit for Persistence Mechanisms
# Check startup entries
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location
# Scheduled tasks (look for suspicious entries)
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } | Select-Object TaskName, TaskPath
# Services with unusual paths
Get-Service | ForEach-Object {
$path = (Get-WmiObject Win32_Service -Filter "Name='$($_.Name)'").PathName
if ($path -notlike "*System32*" -and $path -notlike "*Program Files*") {
[PSCustomObject]@{ Name=$_.Name; Path=$path }
}
}Step 5: Download a Clean Installer
Obtain a fresh copy from the official vendor site, verifying it was published after May 5, 2026 and the version is 12.5.0.2435 or later.
Detection Indicators
| Indicator | Description |
|---|---|
| DAEMON Tools version 12.5.0.2421–2434 | Installer may be trojanized |
| Suspicious processes spawned by DAEMON Tools installer | Malware execution during or after install |
| New scheduled tasks or services with random names | Persistence mechanisms |
| Unusual outbound network connections from new processes | C2 communication |
| Unexpected files dropped in temp or AppData directories | Malware staging |
Post-Remediation Checklist
- Identify if DAEMON Tools Lite versions 12.5.0.2421–2434 are installed
- Uninstall affected versions immediately
- Run full AV/EDR scans and remove identified threats
- Audit startup items, scheduled tasks, and services for unauthorized persistence
- Check network logs for unusual outbound connections during the exposure window
- Reset passwords for accounts used on affected systems, especially cloud/SaaS credentials
- Review browser saved credentials and rotate any stored secrets
- Reinstall from a clean post-May 5, 2026 installer after verifying version number
- Monitor affected systems closely for 30 days post-remediation
- Notify security teams if evidence of exfiltration or lateral movement is found