Loading story…
Attackers compromised part of CPUID’s backend and briefly turned the official cpuid.com download flow into a malware delivery channel for trusted utilities including HWMonitor and CPU-Z. Reports indicate users who downloaded HWMonitor 1.63 or CPU-Z ZIP packages in early April received trojanized files, including an unexpected installer named HWiNFO_Monitor_Setup.exe. CPUID said a secondary feature or side API was breached for roughly six hours, while its signed software files and build pipeline were not compromised; affected links were later pulled and began returning 404 errors.
Analysis of the malicious samples found a multi-stage payload that dropped a fake CRYPTBASE.dll, contacted attacker-controlled infrastructure, and used PowerShell, in-memory execution, process injection, and on-host compilation of a .NET payload to evade detection and fetch follow-on malware. Researchers also observed behavior consistent with browser credential theft through Google Chrome’s IElevation COM interface, and reporting linked the infrastructure to earlier campaigns, including activity previously aimed at FileZilla users. The exact intrusion point remains unconfirmed, though scrutiny has focused on CPUID’s split download infrastructure involving download.cpuid.com and a Cloudflare R2 storage domain.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
By April 13, 2026, CPUID said the secondary API used in the website compromise had been fixed. The company also stated that legitimate direct download URLs and signed binaries were unaffected and that current downloads were safe.
By April 12, 2026, Kaspersky said the CPUID download-link compromise had infected more than 150 victims, mostly individuals but also organizations in retail, manufacturing, consulting, telecommunications, and agriculture. The company said most infections were observed in Brazil, Russia, and China.
By April 10, 2026, the malicious files had reportedly been pulled and affected download links were returning 404 errors. At that time, CPUID had not yet issued a full public statement in one report, while another cited the company's explanation that only a secondary backend component had been compromised.
On April 10, 2026, community reports and researcher analysis identified the malicious samples and described multi-stage behavior including PowerShell use, in-memory execution, process injection, and possible browser credential theft. Analysts also noted overlap between the attacker infrastructure and earlier malware campaigns, including activity linked to FileZilla-themed attacks.
Between April 9 and April 10, 2026, attackers briefly compromised a secondary CPUID backend feature or API and altered website download links to distribute malware. CPUID said its original signed software files and build pipeline were not breached.
Beginning in early April 2026, users downloading HWMonitor 1.63 and CPU-Z ZIP packages from CPUID infrastructure reportedly received malicious files instead of the expected software. The tampered downloads included a fake installer and malware components such as a rogue CRYPTBASE.dll that enabled staged payload delivery and command-and-control communication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 106 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
blog.alphahunt.io
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourceghacks.net
Open sourcethehackernews.com
Open sourceintel.breakglass.tech
Open sourcecybersecuritynews.com
Open sourcegist.github.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CPUID, the developer of **CPU-Z** and **HWMonitor**, confirmed that attackers compromised a backend website component and used a secondary API to replace legitimate download links with malware-laced installers for roughly six hours. The company said its signed software, source code, and build infrastructure were not breached, but the website intermittently served malicious files to users downloading or updating the Windows utilities. Reports from users and researchers, backed by VirusTotal detections, showed the poisoned downloads were delivered from CPUID’s trusted site, making the incident a software supply-chain attack. Analysis shared by researchers indicated the trojanized packages used a malicious `CRYPTBASE.dll` side-load technique, with payloads linked to an **Alien RAT** variant that executed much of its activity in memory via PowerShell, contacted command-and-control infrastructure, and attempted to steal browser credentials and session data from Chrome through the `IElevation` COM interface. Researchers also noted similarities to infrastructure seen in earlier campaigns targeting **FileZilla** users. CPUID took its site offline, removed the malicious links, fixed the abused API, and restored clean downloads, while users who downloaded **CPU-Z** or **HWMonitor** during the affected window were urged to assume compromise, reinstall Windows or otherwise thoroughly clean systems, log out of active sessions, and change passwords.
Jun 29, 2026
Kaspersky reported that the official **cpuid.com** website was used in a watering hole attack that affected downloads of the popular Windows utilities **CPU-Z** and **HWMonitor**. The incident exposed users seeking legitimate system information and hardware monitoring tools to malicious content delivered through the trusted software distribution channel, turning the vendor’s own site into the point of compromise. The attack highlights the risk of software supply-chain abuse through legitimate download portals, particularly for widely used administrative and diagnostic tools. Organizations that allow CPU-Z or HWMonitor in enterprise environments should verify whether any copies were obtained from the compromised site, review affected hosts for signs of unauthorized payload execution, and prioritize integrity checks, endpoint telemetry review, and reinstallation from a known-clean source once vendor remediation is confirmed.
Jun 29, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026