{"id":4036,"date":"2026-04-14T08:54:43","date_gmt":"2026-04-14T06:54:43","guid":{"rendered":"https:\/\/computershop.eu\/blog\/?p=4032"},"modified":"2026-04-14T09:09:13","modified_gmt":"2026-04-14T07:09:13","slug":"the-popular-applications-hwmonitor-and-cpu-z-infected-with-malware","status":"publish","type":"post","link":"https:\/\/computershop.eu\/blog\/the-popular-applications-hwmonitor-and-cpu-z-infected-with-malware","title":{"rendered":"The popular applications HWMonitor and CPU-Z infected with malware"},"content":{"rendered":"Reading Time: <\/span> 2<\/span> minutes<\/span><\/span>\n

A recent cybersecurity incident has caught the attention of the IT community: the popular applications HWMonitor<\/strong> and CPU-Z<\/strong>, developed by CPUID, were used to distribute malware to users. This event highlights the increasing risks associated with supply chain<\/em> attacks and the importance of verifying download sources.<\/p>\n\n\n\n

What happened?<\/h2>\n\n\n\n

According to the latest information appearing on specialized sites (Cybernews, Tom\u2019s Hardware, etc.), the official site of CPUID<\/a> was compromised by unknown attackers. Following the breach, users downloading HWMonitor or CPU-Z received, instead of the legitimate applications, versions infected with malware.<\/p>\n\n\n\n

The attack lasted approximately six hours and was made possible by compromising a secondary API of the site. During this time, the download links were redirected to domains controlled by the attackers, which delivered malicious files instead of the original ones.<\/p>\n\n\n\n

It is important to note that the original files signed digitally were not compromised, only the distribution infrastructure.<\/p>\n\n\n\n

How does this type of malware work?<\/h2>\n\n\n\n

The distributed malware is complex, multi-stage, designed to evade detection by antivirus solutions. Experts have observed that it operated almost entirely in memory and used advanced evasion techniques.<\/p>\n\n\n\n

This type of malware uses PowerShell to download additional files from the attackers’ servers and leaves an address included in the code through which it receives commands.<\/p>\n\n\n\n

To remain undetected, the infected file was named CRYPTBASE.dll, similar to the Windows library used by HWMonitor. The main goal of the attack was to steal sensitive data, especially credentials saved in the browser, such as passwords from Google Chrome.<\/p>\n\n\n\n

In some cases, the downloaded files had suspicious names, such as \u201cHWiNFO_Monitor_Setup.exe\u201d, and showed unusual hints, such as executables in Russian.<\/p>\n\n\n\n

Why is this incident important?<\/h2>\n\n\n\n

This case represents a clear example of a supply chain<\/em> attack, where hackers do not directly compromise the application but the channel through which it is distributed. Such attacks are extremely dangerous because they target trusted software used by millions of people.<\/p>\n\n\n\n

Additionally, the popularity of applications like CPU-Z (used for identifying hardware components) makes the potential impact very significant.<\/p>\n\n\n\n

What should you do if you downloaded the infected applications?<\/h2>\n\n\n\n

If you downloaded or updated HWMonitor or CPU-Z during the affected period, experts recommend:<\/p>\n\n\n\n