CPUID Website Hijacked to Distribute STX RAT Through Trojanized CPU-Z and HWMonitor Downloads
Attackers compromised CPUID's backend API and replaced download links for four popular hardware tools with malware-laden installers, infecting over 150 users across multiple countries.
Overview
The official website of CPUID, the French software vendor behind the widely used hardware diagnostic tools CPU-Z and HWMonitor, was compromised between April 9 and April 10, 2026, with attackers replacing legitimate download links with trojanized installers carrying the STX remote access trojan. Kaspersky, which led the public analysis, has identified more than 150 confirmed infections so far, according to BleepingComputer.
The incident lasted approximately 19 hours, beginning at 15:00 UTC on April 9 and ending around 10:00 UTC on April 10, though CPUID has characterized the active compromise window as roughly six hours. Four products were affected: CPU-Z version 2.19, HWMonitor version 1.63, HWMonitor Pro version 1.57, and PerfMonitor version 2.04, as reported by BleepingComputer.
What We Know
The attackers did not tamper with CPUID’s signed binaries directly. Instead, they compromised what the company described as a “secondary feature (basically a side API),” which caused the main website to randomly serve malicious download links in place of the legitimate ones, according to BleepingComputer. The poisoned links directed users to files hosted on four external domains, including infrastructure on Cloudflare R2 storage.
The trojanized installers used a Russian-language Inno Setup wrapper and bundled a legitimate signed executable alongside a malicious DLL named CRYPTBASE.dll, as reported by BleepingComputer. The DLL exploited a sideloading technique to execute the STX RAT payload, which operated almost entirely in memory to evade endpoint detection and response tools.
Kaspersky’s analysis found that the malware performed anti-sandbox checks before connecting to command-and-control servers. The final payload included information-stealing capabilities such as browser credential theft targeting Google Chrome’s IElevation COM interface, runtime .NET compilation, and process injection, according to The Register.
Kaspersky identified more than 150 victims, primarily individuals, though organizations in retail, manufacturing, consulting, telecommunications, and agriculture were also affected. The infections were concentrated in Brazil, Russia, and China, as reported by BleepingComputer.
What We Don’t Know
No specific threat actor has been publicly attributed. However, Kaspersky found that the attackers reused both the C2 address and connection configuration from a March 2026 campaign involving a fake FileZilla distribution site, according to BleepingComputer. This infrastructure reuse weakened the attackers’ operational security and made detection easier.
The exact method used to compromise CPUID’s backend API has not been disclosed. It remains unclear whether the attackers gained access through a vulnerability in the API itself, stolen credentials, or another vector. The timing of the attack, which coincided with the main developer being away on holiday, suggests the threat actors may have been monitoring the company’s operations, as noted by BleepingComputer.
The full scope of data exfiltrated from infected systems has not been determined. Whether any of the organizational victims suffered follow-on intrusions beyond the initial RAT deployment remains an open question.
Analysis
The CPUID incident follows a pattern that has become increasingly common in supply chain attacks: rather than compromising the software itself, attackers target the distribution infrastructure. By poisoning download links while leaving the original signed binaries intact, the threat actors avoided triggering code-signing verification failures, making the compromise harder to detect through automated means.
CPU-Z and HWMonitor are among the most popular free hardware diagnostic utilities, routinely downloaded by system administrators, hardware reviewers, and power users. Their broad user base makes CPUID’s download infrastructure a high-value target for attackers seeking to cast a wide net with minimal effort.
Users who downloaded any of the four affected tools during the compromise window should assume their systems are potentially compromised. Kaspersky has published indicators of compromise for identification and remediation. CPUID has stated that clean versions are now being served and that the compromised API has been patched.