2026 CPUID (cpuid.com) — watering hole; trojanized CPU-Z / HWMonitor downloads (STX RAT; Apr 9–10)
Data compromised
Endpoint credentials and secrets exfiltrated by malware from infected machines—not a central user database leak
Technical writeup
On April 9–10, 2026, security vendors and researchers reported that the official cpuid.com download workflow was abused in a watering-hole–style supply-chain incident: attackers allegedly compromised a secondary backend API so that certain download buttons resolved to trojanized ZIP/installer packages (e.g., CPU-Z 2.19, HWMonitor 1.63) hosted on attacker infrastructure such as Cloudflare R2 buckets. Packages paired legitimate signed executables with malicious CRYPTBASE.dll side-loaders and staged multi-stage loaders; final payloads were widely attributed to STX RAT / related infostealer behavior targeting browser credentials (e.g., Chrome). Kaspersky Securelist cited telemetry on the order of 150+ victim systems across several countries within roughly a day—treat as a lower-bound sample from one vendor view, not a global census. CPUID publicly acknowledged a time-bounded API-side issue and restored clean distribution.
Root cause
Website/API layer compromise redirecting downloads; not the vendor’s signed source builds per analyses