{"id":"cpuid-download-links-malware-apr-2026","category":"supply-chain","status":"closed","title":"CPUID download links hijacked to spread STX RAT through CPU-Z and HWMonitor downloads","tldr":"CPUID’s official download links sent some Windows users to STX RAT malware on 9–10 April. CPUID fixed the links, but that does not clean infected PCs. If you ran a download from that period, have the computer checked.","summary":"Attackers compromised a secondary CPUID API and changed official download links to send visitors to malicious files. CPUID told BleepingComputer that its original signed files remained intact and the compromise was fixed on 10 April. It described approximately six hours of exposure; Kaspersky observed malicious links from about 15:00 UTC on 9 April to 10:00 UTC on 10 April. Researchers identified malicious downloads presented as CPU-Z 2.19, HWMonitor 1.63, HWMonitor Pro 1.57 and PerfMonitor 2.04. They delivered STX RAT, malware capable of remote control and information theft. Kaspersky identified more than 150 victims, mainly individuals, alongside affected businesses. Restoring the download links did not remove malware already installed on victims’ computers, and no replacement application version was identified as the remedy. As at 3 November, the reviewed sources provide no later account of victim recovery, individual notifications or criminal charges.","action":"If you downloaded and ran one of these Windows tools on 9–10 April, disconnect that PC from the internet and ask your IT support or a trusted computer technician to check it for STX RAT; replacing the application alone is insufficient. From a separate clean device, change passwords used or stored on that PC and revoke existing account sessions. Merely having an older legitimate installation does not establish exposure to this incident.","product":"CPUID Windows downloads: CPU-Z, HWMonitor, HWMonitor Pro and PerfMonitor 2","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cpuid","cpu-z","hwmonitor","windows","supply-chain","malware","stx-rat"],"affected":["CPUID website download links during 9–10 April 2026; CPUID said its original signed application files were not compromised"],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads — includes CPUID’s statement","url":"https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/amp/","by":"BleepingComputer","date":"2026-04-10"},{"kind":"research","title":"CPU-Z / HWMonitor watering hole infection – a copy-pasted attack","url":"https://securelist.com/tr/cpu-z/119365/","by":"Kaspersky","date":"2026-04-16"},{"kind":"news","title":"CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads","url":"https://thehackernews.com/2026/04/cpuid-breach-distributes-stx-rat-via.html","by":"The Hacker News","date":"2026-04-12"}],"started":"2026-04-09","closed":"2026-04-16","created":"2026-11-03T21:23:29.435Z","updated":"2026-11-03T21:23:29.435Z","cve_notes":[],"timeline":[{"at":"2026-04-16","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kaspersky expanded its report with guidance for detecting the malicious activity through its security monitoring system, following detection updates on 14 April.","url":"https://securelist.com/tr/cpu-z/119365/","by":"Kaspersky","patch":null},{"at":"2026-04-10","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kaspersky identified STX RAT as the final malware and reported more than 150 victims, mostly individuals. Most infections in its telemetry were in Brazil, Russia and China.","url":"https://securelist.com/tr/cpu-z/119365/","by":"Kaspersky","patch":null},{"at":"2026-04-10","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"CPUID told BleepingComputer that a secondary API had been compromised for approximately six hours across 9–10 April. It said the breach had been fixed and its original signed files were untouched.","url":"https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/amp/","by":"BleepingComputer","patch":"na"},{"at":"2026-04-09T15:00Z","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kaspersky observed CPUID download links being replaced with links to malicious installers and ZIP archives. Its observed window ended at approximately 10:00 UTC on 10 April.","url":"https://securelist.com/tr/cpu-z/119365/","by":"Kaspersky","patch":null}],"url":"https://hard.fyi/live/cpuid-download-links-malware-apr-2026/","json":"https://hard.fyi/api/live?id=cpuid-download-links-malware-apr-2026"}