CPUID installers delivered STX RAT

The CPUID compromise hit a small but valuable habit: administrators downloading trusted diagnostic tools. On April 9, 2026, users following CPUID's official HWMonitor download path could be redirected away from the expected file and toward an attacker-controlled Cloudflare R2 object.

CPUID later acknowledged that a secondary API had been breached for roughly six hours. The signed original files were not reported compromised. Instead, the download selection path randomly sent some users to malicious packages, with HWMonitor 1.63 confirmed and CPU-Z also reported affected.

The HWMonitor package carried a rogue cryptbase.dll beside the legitimate 64-bit executable. When HWMonitor_x64.exe started, Windows DLL search order loaded the malicious DLL. The loader then unpacked several in-memory stages using reflective PE loading, XOR decryption, and bitwise transforms.

The final payload matched STX RAT, a remote access trojan with infostealer capability. Cyderes reported campaign tags and referrer values that separated HWMonitor from CPU-Z traffic, suggesting a maintained operation aimed at high-value technical users rather than a random drive-by download.