Threat actors compromised the official DAEMON Tools distribution channel beginning April 8, 2026 (discovered approximately one month later in early May 2026), embedding a multi-stage backdoor into digitally signed installers across versions 12.5.0.2421 through 12.5.0.2434. The campaign exploited code-signing trust to bypass security controls, with second-stage payloads selectively deployed against government, scientific, retail, and manufacturing organizations, primarily in Russia, Belarus, and Thailand, though infections reached over 100 countries. Any organization that installed DAEMON Tools during this window faces potential system compromise, data exfiltration, and persistent backdoor access; the campaign was discovered after approximately one month of undetected activity.