Trusted CPU-Z Website Breached: Trojanized Downloads Delivered Malware to Users Worldwide in Supply Chain Attack

CyberDefender 7 mins0

On April 9, 2026, a significant supply chain compromise targeted cpuid[.]com, the official distribution site for widely used system utilities like CPU-Z and HWMonitor. For a limited window—between approximately 15:00 UTC on April 9 and 10:00 UTC on April 10—legitimate download links were silently replaced with malicious ones, exposing users to trojanized installers.

This incident highlights how even trusted software ecosystems can be weaponized, reinforcing the need for proactive cybersecurity hygiene and monitoring.

Timeline and Malicious Infrastructure

During the attack window, users attempting to download legitimate tools were redirected to attacker-controlled domains:

  • cahayailmukreatif.web[.]id
  • pub-45c2577dbd174292a02137c18e7b1b5a.r2[.]dev
  • transitopalermo[.]com
  • vatrobran[.]hr

These domains hosted infected versions of popular utilities. Security researchers later published Indicators of Compromise (IoCs), including file hashes, to aid in detection and incident response.

Attack Chain: From Trusted Software to Remote Access Trojan

The attackers deployed malicious builds of the following tools:

  • CPU-Z (v2.19)
  • HWMonitor Pro (v1.57)
  • HWMonitor (v1.63)
  • PerfMonitor (v2.04)

These trojanized packages were distributed as both ZIP archives and standalone installers. Each contained:

  1. A legitimate, signed executable (to maintain trust)
  2. A malicious DLL named CRYPTBASE.dll

DLL Sideloading Technique

The attackers leveraged DLL sideloading, a well-known technique where a legitimate application unknowingly loads a malicious DLL placed in its directory. Because the executable is signed and trusted, the malicious DLL bypasses basic security checks.

Malware Behavior and Execution Flow

Once executed, the malicious DLL initiates several stages:

1. Anti-Sandbox Checks

The malware verifies whether it is running in a controlled or virtualized environment. If detected, execution halts to evade analysis.

2. Command-and-Control (C2) Communication

If checks pass, the malware connects to a remote server using the following configuration:

{
  "hello": {
    "tag": "tbs",
    "referrer": "cpz",
    "callback": "hxxps://welcome.supp0v3[.]com/d/callback"
  }
}

Notably, the "referrer": "cpz" likely refers to CPU-Z, suggesting campaign tracking by attackers.

3. Payload Construction via MAC Address Encoding

A unique aspect of this loader is its use of a large array of MAC address strings. These are decoded into byte sequences to reconstruct the next-stage payload—an obfuscation technique designed to evade static analysis.

4. Final Payload: STX RAT

The infection chain ultimately deploys STX RAT, a previously documented remote access trojan. This malware provides attackers with capabilities such as:

  • Remote command execution
  • File exfiltration
  • Persistence mechanisms

Interestingly, this RAT was already known and detectable using publicly available YARA rules.

Victimology and Impact

Telemetry data indicates over 150 confirmed victims, including both individuals and organizations. Affected industries include:

  • Retail
  • Manufacturing
  • Telecommunications
  • Consulting
  • Agriculture

Geographically, most infections were observed in:

  • Brazil
  • Russia
  • China

This distribution suggests opportunistic targeting rather than a highly focused campaign.

Detection and Mitigation Strategies

Organizations should take immediate steps to assess exposure:

1. Analyze DNS Logs

2. Inspect File Systems

3. Use IoCs and YARA Rules

4. Enforce Application Integrity

Implement strict validation mechanisms such as:

  • Code signing verification
  • Hash validation
  • Endpoint Detection & Response (EDR)

Comparison with Other Supply Chain Attacks

Compared to incidents like the Notepad++ supply chain attack, this campaign was relatively unsophisticated. While attackers successfully compromised a trusted distribution channel, they failed in operational security by:

  • Reusing known infrastructure
  • Reusing malware (STX RAT)
  • Failing to obfuscate indicators effectively

These mistakes enabled rapid detection and mitigation.

Our Opinion

This incident is a strong reminder that attack sophistication is not always required for impact. Even a poorly executed supply chain attack can compromise hundreds of users if it targets a trusted distribution point. The cpuid.com compromise demonstrates how attackers continue to rely on simple but effective techniques like DLL sideloading and infrastructure reuse.

From a defensive standpoint, the most concerning aspect is not the malware itself—but the implicit trust users place in official download sources. Many organizations still assume that software from legitimate websites is inherently safe, which is no longer a valid assumption in today’s threat landscape.

At the same time, this campaign reveals encouraging signs. The attackers’ reuse of known RATs and infrastructure significantly reduced their stealth, allowing defenders to detect and respond quickly. This suggests that threat intelligence sharing and public detection rules (like YARA) are becoming increasingly effective.

Ultimately, organizations must adopt a zero-trust approach to software installation, including sandbox testing, hash verification, and behavioral monitoring. Trust should be continuously validated—not assumed.

CyberDefender