Loading story…
Kaspersky reported that the official cpuid.com website was used in a watering hole attack that affected downloads of the popular Windows utilities CPU-Z and HWMonitor. The incident exposed users seeking legitimate system information and hardware monitoring tools to malicious content delivered through the trusted software distribution channel, turning the vendor’s own site into the point of compromise.
The attack highlights the risk of software supply-chain abuse through legitimate download portals, particularly for widely used administrative and diagnostic tools. Organizations that allow CPU-Z or HWMonitor in enterprise environments should verify whether any copies were obtained from the compromised site, review affected hosts for signs of unauthorized payload execution, and prioritize integrity checks, endpoint telemetry review, and reinstallation from a known-clean source once vendor remediation is confirmed.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report about a watering hole attack involving CPU-Z, HWMonitor, and cpuid.com. No additional incident details or earlier dated events are provided in the reference metadata.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 38 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CPUID, the developer of **CPU-Z** and **HWMonitor**, confirmed that attackers compromised a backend website component and used a secondary API to replace legitimate download links with malware-laced installers for roughly six hours. The company said its signed software, source code, and build infrastructure were not breached, but the website intermittently served malicious files to users downloading or updating the Windows utilities. Reports from users and researchers, backed by VirusTotal detections, showed the poisoned downloads were delivered from CPUID’s trusted site, making the incident a software supply-chain attack. Analysis shared by researchers indicated the trojanized packages used a malicious `CRYPTBASE.dll` side-load technique, with payloads linked to an **Alien RAT** variant that executed much of its activity in memory via PowerShell, contacted command-and-control infrastructure, and attempted to steal browser credentials and session data from Chrome through the `IElevation` COM interface. Researchers also noted similarities to infrastructure seen in earlier campaigns targeting **FileZilla** users. CPUID took its site offline, removed the malicious links, fixed the abused API, and restored clean downloads, while users who downloaded **CPU-Z** or **HWMonitor** during the affected window were urged to assume compromise, reinstall Windows or otherwise thoroughly clean systems, log out of active sessions, and change passwords.
Jun 29, 2026
Attackers compromised part of CPUID’s backend and briefly turned the official **cpuid.com** download flow into a malware delivery channel for trusted utilities including **HWMonitor** and **CPU-Z**. Reports indicate users who downloaded **HWMonitor 1.63** or CPU-Z ZIP packages in early April received trojanized files, including an unexpected installer named **`HWiNFO_Monitor_Setup.exe`**. CPUID said a secondary feature or side API was breached for roughly six hours, while its signed software files and build pipeline were not compromised; affected links were later pulled and began returning **404** errors. Analysis of the malicious samples found a multi-stage payload that dropped a fake **`CRYPTBASE.dll`**, contacted attacker-controlled infrastructure, and used **PowerShell**, in-memory execution, process injection, and on-host compilation of a .NET payload to evade detection and fetch follow-on malware. Researchers also observed behavior consistent with browser credential theft through Google Chrome’s **IElevation COM** interface, and reporting linked the infrastructure to earlier campaigns, including activity previously aimed at **FileZilla** users. The exact intrusion point remains unconfirmed, though scrutiny has focused on CPUID’s split download infrastructure involving **download.cpuid.com** and a Cloudflare R2 storage domain.
Jun 29, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026