Loading vulnerability…
DAEMON Tools Lite Embedded Malicious Code Vulnerability
CVE-2026-8398 is a supply-chain compromise involving embedded malicious code in official DAEMON Tools Lite installers for Windows. The affected builds are identified as versions 12.5.0.2421 through 12.5.0.2434, distributed approximately between April 8 and May 5, 2026. Attackers compromised AVB Disc Soft's build or distribution infrastructure and modified three core binaries. The malicious binaries carried the vendor's legitimate code-signing certificate, allowing them to pass standard Windows signature verification. Embedded logic executed in dedicated threads, persisted through automatic startup execution, and contacted attacker-controlled infrastructure for host identification and selective payload delivery. Conflicting accounts identify version 11.2.0 and earlier instead; that alternative range is not reconciled with the detailed incident account.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Compromised installations enabled persistent attacker-controlled execution and disclosure of host-identifying information. Selected victims received additional system-profiling software and backdoors capable of downloading files, executing shell commands, and running shellcode in memory. QUIC RAT was observed in one selectively targeted installation. Thousands of machines across more than 100 countries received the trojanized installer, while approximately a dozen organizations received later-stage backdoors. Confidentiality, integrity, and availability impacts are described as high, but specific disruptive or destructive actions are not detailed.
If you can’t patch tonight, do this now.
Follow vendor mitigation instructions and discontinue use of affected software if mitigations are unavailable. Valid vendor code signatures alone do not distinguish the trojanized packages from trustworthy software. No consistently supported, vulnerability-specific temporary workaround is established.
Patch, then assume compromise.
Replace compromised DAEMON Tools Lite installations with a verified clean release. Version 12.6.0.2445 is identified as the vendor's clean replacement build. An alternative recommendation to update to 11.2.1 conflicts with the detailed affected-build range and should not be treated as a reconciled fix. Apply vendor incident-response instructions or discontinue use if mitigations are unavailable. Replacing the application does not establish that separately delivered profiling tools or backdoors have been removed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.