A supply chain attack compromised official installation packages distributed via the legitimate website daemon-tools.cc between April 8, 2026, and May 5, 2026. Attackers accessed the build or distribution infrastructure of the vendor, AVB Disc Soft, to trojanize three binaries: `DTHelper.exe`, `DiscSoftBusServiceLite.exe`, and `DTShellHlp.exe`. Because these files were signed with a legitimate code-signing certificate, they could bypass signature-based detection. This issue involves dangerous undeclared capabilities that may allow a remote attacker to bypass existing security restrictions.