If CPU-Z or HWMonitor are part of your regular toolkit, and let’s be honest, for anyone who tinkers with hardware, they usually are, you need to read this right now. The official CPUID website, the French company behind both tools, was compromised on April 9th and 10th, 2026, and for a window of roughly six hours, downloading either program meant you might have gotten something a lot nastier than a hardware monitor.
CPUID confirmed the breach themselves. A secondary backend feature, essentially a side API, was hijacked, causing the site to randomly serve malicious download links to visitors. The actual installer files sitting on their servers were never touched, but that didn’t matter much if the link pointing to them had been swapped out entirely.
The attackers timed it well, too. Samuel Demeulemeester, a CPUID contributor and maintainer of the CPU-Z Validator tool, told Cybernews that the hackers struck while Franck Delattre, the founder of CPUID and creator of CPU-Z, was away on holiday. By the time anyone noticed, a lot of people had already clicked download.
The red flags were there, if you knew what to look for
The first thing users noticed was the filename. Anyone trying to grab HWMonitor 1.63 through the official page ended up with a file called HWiNFO_Monitor_Setup.exe, a name clearly designed to cause confusion by mixing two completely separate and trusted tools. Then came the Russian-language setup prompts. Then Windows Defender started screaming.
The file landed on VirusTotal and got flagged by at least 32 security vendors as a trojan. Security researchers at vx-underground dug into it and found it was far from a run-of-the-mill piece of malware. The installer was wrapped in a modified Inno Setup package, legitimate HWMonitor installers use a standard, clean version of the same framework, and the payload it dropped was built for stealth.
The malicious file delivered a fake CRYPTBASE.dll, disguised to blend in with legitimate Windows system components. From there, it reached out to an attacker-controlled server to pull down additional payloads, compiled a .NET package directly on the victim’s machine, and injected itself into other running processes. Almost everything happened in memory, leaving as few traces on disk as possible to make detection harder.
Your passwords and sensitive data were the real target
This wasn’t just generic malware dropped for the sake of chaos. In testing, the payload was observed interacting with Google Chrome’s IElevation COM interface, a mechanism that can be used to access and decrypt stored browser credentials. Cybernews confirmed that anyone who installed it should assume their sensitive data, including passwords and crypto wallets, may be at risk.
Researchers also traced the attack infrastructure back to a domain called supp0v3[.]com, the same one used in a campaign that distributed trojanized versions of FileZilla back in March 2026. This wasn’t a one-time opportunistic hit, it’s the same threat group running an active, organized playbook against popular PC software.
One more thing worth clarifying: HWiNFO had nothing to do with any of this. The attackers used its name as a disguise in the malicious filename, which caused some confusion on social media, but the actual HWiNFO software and its official download site were never involved or compromised in any way.
What you should do right now
CPUID says the issue has been fixed and the site is back up serving clean files. But if you downloaded or updated either CPU-Z or HWMonitor at any point between April 3rd and April 10th, 2026, play it safe: run a full antivirus scan immediately, and check your application directories for any sign of cryptbase.dll, which is one of the confirmed indicators of compromise.
Here is the small statement I sent to everyone… 😓
Hi,
Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display… https://t.co/ZfHRoWwkOM
— Doc TB (@d0cTB) April 10, 2026
If the malware did execute, the safe move is to rotate your passwords, revoke any active browser sessions for important accounts, and make sure multi-factor authentication is enabled everywhere that supports it. In a worst-case scenario, a full system reset may be the only way to guarantee a clean slate.
This incident is also a good reminder that even the most routine tools, the kind you’ve installed a dozen times without thinking twice, can become a threat vector when the infrastructure behind them gets targeted. The code itself was fine. The problem was everything around it.
Have you ever been caught off guard by malware hiding in a trusted download? Drop your experience in the comments, we’d love to know how you handled it!