Tens of M

CPU-Z users globally

~6 hrs

Malicious downloads served

5th

Supply chain attack since Mar 25

2

Supply chain attacks today

WHAT HAPPENED

On April 9, Reddit users noticed something wrong with HWMonitor downloads from the official CPUID website. The installer had an unfamiliar filename, HWiNFO_Monitor_Setup.exe, and a Russian-language install dialog. VirusTotal submissions confirmed malicious content. By April 10, security researchers from Cyderes, vx-underground, and Kaspersky had published analyses confirming a supply chain compromise of CPUID's download infrastructure.

CPUID confirmed the breach in a statement to BleepingComputer: "Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links." CPUID emphasized that their signed original files were not compromised. The attackers did not tamper with the legitimate binaries. They hijacked the download links to point at attacker-hosted copies on Cloudflare R2 storage.

The timing was deliberate. CPUID's main developer was away on holiday when the attack occurred, reducing the speed of detection and response. This mirrors the pattern we documented in the Anodot/Snowflake breach earlier this week, where ShinyHunters timed their bulk exfiltration to a bank holiday. Attackers are consistently choosing windows when human response capacity is at its lowest.

THE MALWARE

The trojanized installer included a malicious CRYPTBASE.dll placed alongside the legitimate application binary. This is a classic DLL sideloading technique. When the legitimate executable loads, Windows searches for CRYPTBASE.dll and finds the attacker's version first. The malware executes in the context of the trusted application.

From there, the payload escalates in stages. It uses PowerShell to fetch additional components from the attacker-controlled infrastructure at supp0v3[.]com. The malware operates almost entirely in memory, avoiding disk writes that would trigger traditional antivirus. It downloads and compiles a .NET payload on the victim machine, then injects it into other processes. The primary objective appears to be browser credential theft, with specific targeting of Google Chrome's IElevation COM interface to dump and decrypt saved passwords.

vx-underground's assessment was direct: "This is not your typical run-of-the-mill malware. This malware is deeply trojanized, distributes from a compromised domain, performs file masquerading, is multi-staged, operates almost entirely in-memory, and uses some interesting methods to evade EDRs and/or AVs such as proxying NTDLL functionality from a .NET assembly." They also confirmed this is the same threat group that compromised FileZilla downloads in early March 2026.

ATTACK CHAIN

Figure 01

  1. 01
    API compromise. Attacker gains access to a secondary API on CPUID's backend infrastructure. This API controls the download links displayed on the official product pages.
  2. 02
    Link substitution. Official download links for CPU-Z and HWMonitor are redirected to attacker-hosted packages on Cloudflare R2 storage. The website appears completely normal. The download buttons look the same. The URL change is invisible to the user.
  3. 03
    DLL sideloading. The trojanized package includes a malicious CRYPTBASE.dll alongside the legitimate executable. When the application launches, it loads the attacker's DLL automatically through Windows' standard DLL search order.
  4. 04
    In-memory execution. The DLL reaches out to the C2 at supp0v3[.]com, downloads additional payloads via PowerShell, compiles a .NET payload on the victim machine, and injects into other processes. Minimal disk footprint. Designed to evade EDR and antivirus.
  5. 05
    Credential theft. The malware targets browser credentials, specifically Chrome's IElevation COM interface for password dump and decryption. Stolen credentials are exfiltrated to the C2. The attacker now has the victim's saved passwords for every site they visit.

THE SUPPLY CHAIN PATTERN

This is the fifth supply chain attack we have covered since March 25. Here is the timeline:

March 25: TeamPCP supply chain cascade compromises Trivy, Checkmarx, and LiteLLM through poisoned Python packages. Developer endpoints become credential harvesting operations.

March 31: Axios npm package hijacked by North Korea's UNC1069. 100M+ weekly downloads. Cross-platform RAT deployed through the most widely used HTTP client library in the JavaScript ecosystem.

April 9 (AM): Anodot/Snowflake integration breach. ShinyHunters steals authentication tokens from a SaaS analytics provider and raids 12+ Snowflake customer accounts.

April 10 (AM): Smart Slider 3 Pro WordPress plugin update system hijacked. 800,000 installations. Fully weaponized remote access toolkit pushed through official update channel.

April 10 (PM): CPUID's CPU-Z and HWMonitor download infrastructure hijacked. Tens of millions of users. Trojanized installers served from the official website for six hours.

Five attacks in sixteen days. Five different ecosystems. Python packages, npm libraries, SaaS integrations, WordPress plugins, and now native Windows application downloads. The attackers are systematically working through every type of software distribution infrastructure that exists. The common thread is not the technology. It is the trust. Every one of these attacks exploits the same assumption: if the download comes from the official source, it is safe.

INDICATORS OF COMPROMISE

INCIDENT DETAILS

  • Affected tools //

    CPU-Z 2.19, HWMonitor 1.63, potentially other CPUID utilities

  • Compromise window //

    April 9 ~15:00 UTC to April 10 ~10:00 UTC (Kaspersky)

  • C2 domain //

    supp0v3[.]com (same as March 2026 FileZilla campaign)

  • Malicious DLL //

    CRYPTBASE.dll (DLL sideloading)

  • Hosting //

    Cloudflare R2 (attacker-controlled bucket, not CPUID infrastructure)

  • Installer name //

    HWiNFO_Monitor_Setup.exe (misnamed, Russian-language Inno Setup)

  • Threat group //

    Same actor behind FileZilla hijack, early March 2026

  • Primary objective //

    Browser credential theft (Chrome IElevation COM targeting)

DEFENSE TAKEAWAYS

  1. 1

    If you downloaded CPU-Z or HWMonitor from cpuid.com between April 9 and April 10, assume the download was compromised. Run a full malware scan. Check for CRYPTBASE.dll in the installation directory. Review browser saved passwords and consider them exposed.

  2. 2

    Monitor network logs for connections to supp0v3[.]com. This C2 domain has been active since at least March 2026 and is linked to multiple supply chain campaigns. If you see traffic to this domain, investigate the source system immediately.

  3. 3

    Verify download hashes before installing any system utility. CPUID's signed original files were not compromised, meaning the legitimate hashes are still valid for comparison. If your installer's hash does not match the vendor's published hash, do not run it.

  4. 4

    Block DLL sideloading where possible. Windows Application Control policies and endpoint protection rules that prevent unsigned DLLs from loading alongside trusted executables would have caught this attack at the execution stage regardless of how the installer was delivered.

  5. 5

    Rotate any passwords saved in Chrome or other browsers on systems where CPUID tools were recently installed. The malware specifically targeted browser credential stores. If it executed successfully, every saved password on that machine should be treated as compromised.