CPUID Got Hacked for 6 Hours — 150 People Downloaded a Fake CPU-Z With a Full RAT Inside
CPUID Got Hacked for 6 Hours — 150 People Downloaded a Fake CPU-Z With a Full RAT InsideHonestly, the one tool every PC builder trusts just got turned into a weapon. For six hours, downloading HWMonitor from the official site gave you a remote access trojan instead.
Between April 9–10, 2026, hackers broke into CPUID’s website and swapped the real downloads for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor with trojanized copies — infecting 150+ users in Brazil, Russia, China, and more.
The malware? A thing called STX RAT — a remote access trojan (basically a backdoor that gives hackers full control of your PC). It stole browser passwords, crypto wallets, VPN logins, and session cookies. All from a site you’ve been downloading from since you built your first rig. [Source: Tom’s Hardware]
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Supply chain attack | Instead of attacking YOU directly, hackers attack a trusted tool you download — so the poison comes wrapped in something you trust |
| DLL sideloading | Tricking a legit program into loading a fake helper file (a .dll) instead of the real one — like swapping someone’s vitamins with cyanide pills |
| RAT (Remote Access Trojan) | Malware that gives a hacker full remote control of your computer — they can see your screen, steal your files, the works |
| Trojanized installer | A normal-looking setup file that secretly installs malware alongside (or instead of) the program you wanted |
| Session cookies | Little files your browser uses to keep you logged in — steal those and a hacker IS you on that site, no password needed |
| Cloudflare R2 | A cloud storage service — the attackers stored their fake downloads there to make them load fast and look legit |
| Anti-sandbox checks | The malware checks if it’s being analyzed in a security lab — if yes, it plays dead so researchers can’t study it |
🔍 How the Attack Actually Worked
This wasn’t some random phishing email. The attackers found a weak spot — a secondary API (basically a side door that connects to the website’s backend) — and used it to silently swap download links on CPUID’s official site.
- What got hit: CPU-Z v2.19, HWMonitor v1.63, HWMonitor Pro v1.57, PerfMonitor v2.04
- How it worked: Download links were redirected to attacker-controlled Cloudflare R2 storage buckets
- Only 64-bit versions were affected — the malicious
cryptbase.dllwas placed next to the legit.exe - When you ran the installer, it loaded the fake DLL first (Windows searches the current folder before the system folder — classic DLL search order hijacking)
- The malware ran entirely in memory across 5 stages — XOR decryption, reflective loading, bitwise transformations. No files on disk to catch.
CPUID founder Samuel Demeulemeester confirmed the breach was found and patched. Current downloads are safe. (Cybernews report)
🎯 What STX RAT Actually Stole
Once it was in, STX RAT went shopping through your entire digital life:
Browser credentials — saved passwords from Chrome, Firefox, Edge
Session cookies — instant login to your accounts without passwords
Crypto wallet keys — MetaMask, Exodus, anything in your browser extensions
Password manager data — if your vault was unlocked, it was fair game
VPN and FTP credentials — your “secure” connections, handed over- It specifically used Chrome’s IElevation COM interface to decrypt stored credentials (that’s the same API Chrome uses internally to protect your passwords — the RAT just… asked nicely)
The same command-and-control server was previously linked to a fake FileZilla campaign in March 2026. Same attackers, different bait.
📊 The Receipts
| Stat | Number |
|---|---|
| Time the site was compromised | ~6 hours |
| Confirmed malicious downloads | 150+ |
| Products affected | 4 (CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor) |
| Malware stages in memory | 5 |
| Countries with confirmed infections | Brazil, Russia, China + more |
| Sectors hit | Retail, manufacturing, telecom, consulting, agriculture |
| Windows Defender catch rate | Most caught it before execution |
| Attackers identified | Unknown (linked to March FileZilla campaign) |
🗣️ What People Are Saying
- CPUID’s founder: “A secondary feature (basically a side API) was compromised for approximately six hours… our signed original files were not compromised.”
- vx-underground (malware research group): Pointed out the C2 server matches the March fake FileZilla site — meaning this crew has been running supply-chain poisoning campaigns for months
- Security researchers at Cyderes: Published a full breakdown of the 5-stage in-memory execution chain
- The PC building community: Collectively had a “wait, I literally just downloaded that last week” moment
- The Russian install prompt was apparently a giveaway — but honestly, how many of us actually read installer windows? Exactly.
⚙️ Why This Matters More Than You Think
Okay but seriously — this is the exact nightmare scenario for supply-chain security. CPU-Z and HWMonitor aren’t some sketchy utilities from a random forum. These are the tools that hardware reviewers, overclockers, system admins, and basically every PC builder on the planet has used at some point.
The attack wasn’t sophisticated in concept (swap links → serve malware). What was sophisticated was the malware itself — five stages, entirely in memory, anti-analysis tricks, going after the Chrome credential API directly. This is professional-grade stuff.
And 150 users sounds small, but several of those were organizations — meaning the RAT potentially had access to corporate networks, not just some kid’s gaming rig. One infected telecom employee’s machine could be the entry point for something much bigger.
The lesson? Even official sites from trusted developers can become watering holes. Your “safe” download habit of “always get it from the official site” isn’t enough anymore.
Cool. So Trusted Downloads Are Cooked Now… What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🕳️ The Hash Checker Hustle
Every legit software publisher posts file hashes (like SHA-256 checksums) — a unique fingerprint for the real file. But almost nobody checks them. Build a dead-simple browser extension or desktop widget that auto-verifies downloaded files against known-good hashes from the publisher’s site. Make it one click. Target the PC builder / sysadmin crowd who downloads tools like CPU-Z, Rufus, 7-Zip constantly.
Monetize through a freemium model — free for personal use, paid tier for teams that need audit logs. Nobody’s done this in a way that’s actually frictionless.
Example: A 24-year-old dev in Poland builds “HashGuard,” a free tray app that auto-checks every .exe download against a curated hash database. Posts it on r/sysadmin and GitHub. 8,000 stars in a week. Enterprise tier at $5/seat/month. 200 small MSPs sign up in month two — $12K MRR.
Timeline: First version shipped in 3 days (it’s honestly a simple app). First paying users within 2 weeks of Reddit launch. Plateau at ~$30K MRR unless you land a big compliance customer. Window closes when browsers add this natively — maybe 18 months.
📡 The Supply Chain Canary
Set up automated monitoring that downloads popular free tools (CPU-Z, HWMonitor, Rufus, PuTTY, WinSCP, FileZilla — the whole Greatest Hits of Windows utilities) every 30 minutes, hashes them, and compares against known-good versions. When a hash changes unexpectedly? Instant alert to a subscriber list.
This is a VirusTotal meets early-warning system for supply-chain attacks. Charge security teams for the API. The data is gold — you’d have caught this CPUID breach within 30 minutes instead of 6 hours.
Example: A 28-year-old security analyst in Romania sets up 40 cron jobs on a $5/month VPS that download and hash popular tools every 30 min. Wraps it in a Telegram bot and Discord webhook. Posts the free version on Hacker News. Gets picked up by 3 threat intel firms who want API access at $200/month each. Bootstrapped to $2K/month with zero ad spend.
🎣 The DLL Sideload Audit Kit
DLL sideloading (tricking programs into loading a fake helper file) is the #1 technique used in these attacks. Build a free scanning tool that checks a user’s installed software for DLL sideload vulnerabilities — does this .exe load DLLs from its own folder before the system folder? Is the folder writable by non-admins?
Package it as a penetration testing tool for red teams AND as a defensive scanner for blue teams. Post on GitHub. The hustle: consulting gigs and custom enterprise scanning for companies who realize their entire software stack is vulnerable to this.
Example: A 31-year-old pentester in Turkey builds “SideloadScan” — a Python script that scans Program Files for sideload-vulnerable executables. Open-sources it, writes a blog post with results from scanning 500 popular Windows apps. Gets invited to speak at BSides. Lands 3 consulting contracts at $5K each within a month from companies who saw their own apps in the vulnerable list.
🪟 The Patch Window Flipper
Right now, between when a supply-chain attack is discovered and when it makes mainstream news, there’s a 24-72 hour gap where most users don’t know. During this window, security-aware resellers on eBay/Amazon who sell pre-configured PCs and USB toolkits can pivot HARD — market “verified clean” utility USB sticks with hash-checked versions of popular tools.
The PC building community is paranoid right now. Sell them peace of mind: a $15 USB stick with CPU-Z, HWMonitor, CrystalDiskMark, Rufus, and 20 other essentials, all verified, all signed. Update it monthly. Subscription model for the USB image file.
Example: A 19-year-old in Indonesia who already sells custom PC build kits on Tokopedia adds a “Verified Tool Pack” USB for $12. Posts a TikTok showing the CPUID hack and saying “this is why I check every hash.” Sells 400 units in the first week. Pivots to a $3/month digital download of the verified pack.
🔐 The Cookie Monster Defense
STX RAT’s main prize was session cookies — those little tokens that keep you logged in. Most people don’t know you can delete all your cookies and re-authenticate, or use browser profiles to isolate sensitive logins. Build a step-by-step “post-breach cleanup” guide specifically for the CPUID victims (and anyone else who’s been popped). Offer it free. Upsell a “digital hygiene audit” service where you remote into their machine, verify they’re clean, rotate all credentials, and set up proper isolation.
The timing is perfect — 150+ people just got compromised and most don’t know what to do next.
Example: A 26-year-old IT support freelancer in the Philippines writes a free Notion guide called “You Got RAT’d: Now What” — 12 steps from running Malwarebytes to rotating every password to setting up browser profiles. Posts it everywhere the CPUID news is being discussed. Offers a $50 “done for you” remote cleanup session. Gets 30 bookings in the first 5 days just from Reddit threads.
🛠️ Follow-Up Actions
| Want To… | Do This |
|---|---|
| Check if you downloaded the bad version | Verify your CPU-Z/HWMonitor installer hash against CPUID’s official hashes — if you downloaded between April 9-10, assume compromised |
| Scan for STX RAT | Run Malwarebytes + Windows Defender full scan. Check for cryptbase.dll in your CPU-Z / HWMonitor folders |
| Protect your browser creds | Clear all cookies, reset all passwords, enable 2FA everywhere. Consider Bitwarden if you’re still saving passwords in Chrome |
| Prevent DLL sideloading | Run software from Program Files (which requires admin to write to), not random folders. Use Windows Defender ASR rules |
| Verify future downloads | Always check SHA-256 hashes. Use HashCheck shell extension for right-click verification |
Quick Hits
| Want To… | Do This |
|---|---|
 Check if you’re affected |
Downloaded CPU-Z/HWMonitor on April 9-10? Run a full Malwarebytes scan immediately |
| Protect your passwords |
Stop saving passwords in Chrome. Switch to Bitwarden (free) and enable 2FA on everything |
| Kill stolen sessions |
Log out of all devices on Google, Discord, GitHub, etc. — session cookies mean the hacker doesn’t need your password |
| Verify downloads going forward |
Install HashCheck — right-click any file to see its SHA-256 hash, compare with official site |
 Stay ahead of supply chain attacks |
Follow @vabornh and vx-underground for real-time malware intel |
The official site WAS the malware site. Sleep tight, fam.
!