CVE-2026-8398
Daemon Tools Lite Embedded Malicious Code Vulnerability
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-05-30.
7 articles across 4 outlets · first covered May 27, 2026 · latest May 28, 2026
Coverage timeline
-
CISA warns of Daemon Tools, TanStack and Nx Console flawssecurityaffairs.com · May 28, 2026
-
Showboat malware leverages critical CVEs to spy on telecomssecurityonline.info · May 28, 2026
-
FortiClient EMS flaw used to drop EKZ Infostealer via fake updatessecurityonline.info · May 28, 2026
-
Active exploits found today hide malicious code in popular toolssecurityonline.info · May 28, 2026
-
Motorola Fixes Amazon App Redirect Bug After Smart Feed Abusesecurityonline.info · May 28, 2026
-
CISA urges action on Daemon Tools Lite CVE-2026-8398 vulnerabilitywww.cisa.gov · May 28, 2026
-
Critical CVE‑2026‑8398 Flaw Hits Daemon Tools Lite, Exploitedcisa.gov · May 27, 2026