CPU-Z Website Hacked: Trojanized Downloads Delivered STX RAT to 150+ Victims

Supply chain attacks are frightening precisely because they exploit trust — and few tools carry more implicit trust among Windows power users and IT professionals than CPU-Z and HWMonitor, the system diagnostics utilities distributed by CPUID. On April 9–10, 2026, attackers turned that trust into a weapon: for approximately 19 hours, anyone who visited cpuid.com and downloaded what appeared to be a legitimate installer received something far more dangerous — a trojanized package quietly deploying the STX RAT, one of the most capable remote access trojans currently observed in the wild. At least 150 victims across five industry sectors are now confirmed compromised.

How the Attack Unfolded: 19 Hours Inside CPUID’s Infrastructure

The breach window ran from approximately April 9, 2026, at 15:00 UTC to April 10, 2026, at 10:00 UTC — 19 hours during which cpuid.com served malicious content without triggering automated alerts that would prompt remediation. The attackers accessed CPUID’s web infrastructure and surgically replaced the legitimate download URLs for both CPU-Z and HWMonitor with links pointing to trojanized installer packages hosted on attacker-controlled infrastructure.

The modification was deliberately minimal — the visual presentation of the download pages remained unchanged, and the file names mimicked legitimate installer naming conventions exactly. Users who had previously bookmarked or linked directly to CPUID’s download pages received no visual warning that anything was amiss. Even security-conscious users who checked file sizes might not have noticed, as the trojanized packages were padded to approximate the expected file size.

The delivery mechanism relied on a particularly elegant technique: DLL side-loading via a malicious CRYPTBASE.dll. The trojanized installer placed this crafted DLL alongside a legitimate signed executable, causing Windows to load the malicious library through the normal DLL search order — entirely bypassing application allowlisting controls that check the main executable’s signature rather than its dependencies.

The STX RAT Payload: Capabilities, Delivery, and Why It’s Dangerous

The STX RAT is not a commodity tool. Researchers analyzing the payload describe a sophisticated remote access trojan with a feature set that suggests development resources and operational security discipline well beyond typical cybercriminal tooling. Its most dangerous characteristic is in-memory execution — the RAT’s core modules never write a conventional executable to disk in their active form, making them invisible to file-based detection by endpoint security products scanning the filesystem.

The full capability stack includes Hidden Virtual Network Computing (HVNC) — allowing attackers to operate a fully interactive desktop session on the victim machine without the user’s knowledge, with no taskbar indication or cursor movement visible to the machine’s legitimate user. Coupled with an integrated infostealer module that exfiltrates credentials, browser cookies, saved passwords, and cryptocurrency wallet files, and a reverse proxy capability that can route further attacker traffic through the compromised host, STX RAT provides essentially complete operational control of an infected machine.

Command-and-control communications are encrypted and designed to blend with legitimate HTTPS traffic patterns, complicating network-level detection. Kaspersky researchers, who were among the first to publish detailed technical analysis of the payload, described it as among the more capable RATs observed in recent campaigns — suggesting either a well-funded threat actor or one with access to high-quality commercial crimeware.

Victim Profile: Who Was Hit and What Sectors Were Exposed

Kaspersky’s analysis identified over 150 confirmed victims across five distinct industry verticals: retail, manufacturing, telecommunications, consulting, and agriculture. The geographic distribution spans Brazil, Russia, and China, suggesting either a globally dispersed threat actor or a case where the infected software’s popularity across these markets drove the victim distribution organically.

The sector spread is notable because it suggests the attackers were not targeting a specific industry vertical — they were harvesting opportunistically from the pool of IT and engineering professionals who routinely use CPU-Z and HWMonitor for hardware diagnostics. These are tools disproportionately used by system administrators, hardware engineers, and IT operations staff — precisely the individuals with the elevated privileges and network access that make a RAT infection maximally valuable.

The 150+ figure represents confirmed forensic cases and almost certainly understates the true victim count. Many infections may not yet be detected given STX RAT’s in-memory execution model, and organizations in the affected sectors should treat any CPU-Z or HWMonitor download during the April 9–10 window as a confirmed compromise requiring full incident response procedures.

Lessons Learned: Software Supply Chain Risk in the Developer Tooling Space

The CPUID breach joins a growing canon of software supply chain attacks that exploit the implicit trust users place in well-known utility software. SolarWinds, 3CX, and now CPUID share a common attack surface: organizations that maintain high-trust software distributions but whose web infrastructure security may not match the level of trust their users extend to their products.

For security teams, this incident reinforces several tactical imperatives. First: hash verification of downloads from any software vendor is essential — not just trust-by-reputation. CPUID publishes SHA256 hashes for legitimate releases; any download during the breach window that doesn’t match historical known-good hashes should be treated as malicious immediately. Second: privileged user device isolation is not optional. System administrators running diagnostic utilities on domain-connected machines with elevated privileges create an attack surface that single-handedly justifies the effort of a supply chain compromise.

The broader lesson for the industry is systemic: the open distribution model that makes developer and IT utility software accessible and useful is the same model that makes it an attractive attack vector. Until code signing, reproducible builds, and automatic binary verification become standard requirements for all software in the IT professional tooling category, supply chain attacks of this type will continue to yield high-value victims from a single well-executed infrastructure compromise.

Frequently Asked Questions