Loading story…
CPUID, the developer of CPU-Z and HWMonitor, confirmed that attackers compromised a backend website component and used a secondary API to replace legitimate download links with malware-laced installers for roughly six hours. The company said its signed software, source code, and build infrastructure were not breached, but the website intermittently served malicious files to users downloading or updating the Windows utilities. Reports from users and researchers, backed by VirusTotal detections, showed the poisoned downloads were delivered from CPUID’s trusted site, making the incident a software supply-chain attack.
Analysis shared by researchers indicated the trojanized packages used a malicious CRYPTBASE.dll side-load technique, with payloads linked to an Alien RAT variant that executed much of its activity in memory via PowerShell, contacted command-and-control infrastructure, and attempted to steal browser credentials and session data from Chrome through the IElevation COM interface. Researchers also noted similarities to infrastructure seen in earlier campaigns targeting FileZilla users. CPUID took its site offline, removed the malicious links, fixed the abused API, and restored clean downloads, while users who downloaded CPU-Z or HWMonitor during the affected window were urged to assume compromise, reinstall Windows or otherwise thoroughly clean systems, log out of active sessions, and change passwords.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Following disclosure of the incident, security experts advised anyone who downloaded CPU-Z or HWMonitor on April 9 or April 10 to treat their systems as compromised. Recommended actions included reinstalling Windows or otherwise cleaning infected systems, logging out of active sessions, and changing passwords.
Security researchers observed similarities between the infrastructure used in the CPUID incident and an earlier 2026 campaign targeting FileZilla users. This suggested the compromise may have been part of a broader credential-stealing operation.
Analysis shared by vx-underground found the malicious installer used a fake Zig-compiled CRYPTBASE.dll, executed much of its activity in memory via PowerShell, contacted command-and-control infrastructure, and attempted to steal browser credentials through Chrome-related mechanisms. Reporting identified the payload as an Alien RAT variant focused on passwords and session tokens.
CPUID stated that attackers abused a compromised backend component or secondary API to swap legitimate download links with malicious ones. The company temporarily took its website offline, removed the malicious links, and later restored clean download routing after fixing the issue.
During the incident, users and security researchers reported on X and Reddit that CPUID downloads were infected, and VirusTotal detections indicated the installers contained trojanized malware. These reports helped surface the compromise publicly.
Between April 9 and April 10, CPUID's website was compromised and randomly displayed malicious links for CPU-Z and HWMonitor downloads, affecting both direct downloads and some in-app updates. CPUID said its signed software files, source code, and build process were not compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
neowin.net
Open sourcecyberwarzone.com
Open sourcecybernews.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised part of CPUID’s backend and briefly turned the official **cpuid.com** download flow into a malware delivery channel for trusted utilities including **HWMonitor** and **CPU-Z**. Reports indicate users who downloaded **HWMonitor 1.63** or CPU-Z ZIP packages in early April received trojanized files, including an unexpected installer named **`HWiNFO_Monitor_Setup.exe`**. CPUID said a secondary feature or side API was breached for roughly six hours, while its signed software files and build pipeline were not compromised; affected links were later pulled and began returning **404** errors. Analysis of the malicious samples found a multi-stage payload that dropped a fake **`CRYPTBASE.dll`**, contacted attacker-controlled infrastructure, and used **PowerShell**, in-memory execution, process injection, and on-host compilation of a .NET payload to evade detection and fetch follow-on malware. Researchers also observed behavior consistent with browser credential theft through Google Chrome’s **IElevation COM** interface, and reporting linked the infrastructure to earlier campaigns, including activity previously aimed at **FileZilla** users. The exact intrusion point remains unconfirmed, though scrutiny has focused on CPUID’s split download infrastructure involving **download.cpuid.com** and a Cloudflare R2 storage domain.
Jun 29, 2026
Kaspersky reported that the official **cpuid.com** website was used in a watering hole attack that affected downloads of the popular Windows utilities **CPU-Z** and **HWMonitor**. The incident exposed users seeking legitimate system information and hardware monitoring tools to malicious content delivered through the trusted software distribution channel, turning the vendor’s own site into the point of compromise. The attack highlights the risk of software supply-chain abuse through legitimate download portals, particularly for widely used administrative and diagnostic tools. Organizations that allow CPU-Z or HWMonitor in enterprise environments should verify whether any copies were obtained from the compromised site, review affected hosts for signs of unauthorized payload execution, and prioritize integrity checks, endpoint telemetry review, and reinstallation from a known-clean source once vendor remediation is confirmed.
Jun 29, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026