CPUID Website Breach Exposes Users to Malware

The CPUID website, known for its popular hardware monitoring tools such as HWMonitor and CPU-Z, was compromised by unknown attackers between April 9 and April 10, 2026. During this six-hour window, users attempting to download these utilities were instead served malicious installers. The breach was confirmed by CPUID, which stated that a secondary API had been compromised, allowing attackers to redirect download links to infected files.

Security PSA: Popular Tools CPU-Z and HWMonitor Were Briefly CompromisedCPUID compromised, HWMonitor and CPU-Z delivered malwareHWMonitor and CPU-Z developer CPUID breached by unknown attackers — cyberattack forced users to download malware instead of valid apps for six hoursThe Register UK

The malicious payload primarily targeted users of the 64-bit version of HWMonitor. It masqueraded as a legitimate Windows library named CRYPTBASE.dll, designed to blend in with genuine system components. Analysis by vx-underground revealed that the malware aimed to steal browser credentials, particularly targeting Google Chrome's stored passwords. The malware employed sophisticated evasion techniques, operating largely in memory and utilizing PowerShell to fetch additional payloads from a command-and-control server.

CPUID compromised, HWMonitor and CPU-Z delivered malwareThe Register UKHWMonitor and CPU-Z developer CPUID breached by unknown attackers — cyberattack forced users to download malware instead of valid apps for six hoursSecurity PSA: Popular Tools CPU-Z and HWMonitor Were Briefly Compromised

Samuel Demeulemeester, a representative of CPUID, acknowledged the breach and assured users that the original software files remained uncompromised. He stated, “Investigations are still ongoing, but it appears that a secondary feature... was compromised... causing the main website to randomly display malicious links.” The company has since rectified the issue and restored the website's integrity.

CPUID compromised, HWMonitor and CPU-Z delivered malware

Despite the swift response from CPUID, concerns have been raised regarding the security measures in place to protect users. Critics argue that the incident highlights vulnerabilities in the software supply chain, with some users expressing frustration over the lack of proactive communication from CPUID during the attack. One user noted, “It seems that the primary goal of the malware was to steal browser credentials,” emphasizing the potential risks associated with such breaches.

CPUID compromised, HWMonitor and CPU-Z delivered malware

While CPUID has confirmed the breach and its resolution, there remains uncertainty regarding the extent of the impact. The company has not disclosed how many users may have downloaded the infected files, nor the specific methods employed by the attackers to gain access to the API. Additionally, some users reported that their antivirus software flagged the malicious downloads, while others were unaware until after installation.

HWMonitor and CPU-Z developer CPUID breached by unknown attackers — cyberattack forced users to download malware instead of valid apps for six hours

As investigations continue, cybersecurity experts are urging users to exercise caution when downloading software from the internet. Recommendations include verifying file hashes and avoiding unverified installers. CPUID is expected to enhance its security protocols to prevent future incidents, and users are advised to monitor their accounts for any suspicious activity following the breach.

CPUID compromised, HWMonitor and CPU-Z delivered malware

• “The breach was found and has since been fixed.” — Samuel Demeulemeester, CPUID

The Register UK

• “Whoever developed this malware actually cares about evasion and made some intelligent decisions when developing this malware payload,” — vx-underground Analyst

CPUID compromised, HWMonitor and CPU-Z delivered malware

• “It appears the ultimate goal of this malware is data theft, specifically browser credentials.” — vx-underground Analyst

CPUID compromised, HWMonitor and CPU-Z delivered malware

This incident serves as a critical reminder of the vulnerabilities inherent in software distribution and the importance of robust cybersecurity measures.

CPUID compromised, HWMonitor and CPU-Z delivered malware