CPUID website hijacked to serve RAT malware through official CPU-Z and HWMonitor downloads

Attackers compromised a backend API on CPUID's website and replaced the official download links for CPU-Z and HWMonitor with trojanized versions containing the STX RAT. The attack lasted approximately six hours between April 9-10, timed to when the lead developer was on holiday. The malicious packages used DLL sideloading - legitimate CPUID executables (still properly signed) were bundled alongside a malicious CRYPTBASE.dll that masquerades as a standard Windows library. When users launched HWMonitor or CPU-Z, the malicious DLL loaded and deployed the RAT entirely in memory, with four independent persistence paths. The primary goal was browser credential theft, specifically targeting Chrome's IElevation COM interface to dump and decrypt saved passwords. The same threat group previously compromised FileZilla downloads in early March 2026. CPUID's signed original files were not tampered with - this was an infrastructure attack redirecting download links to attacker-controlled Cloudflare R2 storage.

Check

Check if anyone in your organization downloaded CPU-Z or HWMonitor from cpuid.com between April 9-10. These are popular IT diagnostic tools that sysadmins and technicians frequently download.

Affected

Anyone who downloaded CPU-Z 2.19, HWMonitor 1.63, or other CPUID utilities from cpuid.com during the approximately six-hour compromise window (April 9-10, 2026). If the installer showed Russian-language prompts or was named HWiNFO_Monitor_Setup.exe instead of the expected CPUID filename, the system is compromised.

Fix

If you downloaded during the compromise window: consider the host fully compromised and re-image the machine. The malware has 4 independent persistence paths and may have delivered additional C2 payloads. At minimum: rotate all browser-saved passwords immediately (Chrome passwords are the primary theft target), scan for the CRYPTBASE.dll sideloading indicator, and block supp0v3[.]com at the network level. For ongoing protection: verify file hashes against known-good CPUID releases before running.