CPUID download infrastructure hijacked to distribute STX RAT

On 9 April 2026, attackers compromised a backend component used by CPUID's official website and replaced legitimate download destinations for CPU-Z, HWMonitor, HWMonitor Pro and PerfMonitor 2 with attacker-controlled packages. The trojanized downloads combined legitimate software components with a malicious DLL that ultimately deployed STX RAT. Kaspersky observed malicious redirects through 10 April and identified more than 150 infections, including organizations in retail, manufacturing, consulting, telecommunications and agriculture, with most observed infections in Brazil, Russia and China. Although CPUID's original signed binaries were not modified, compromise of the trusted vendor download path created a direct software-supply-chain data-integrity impact.