CPUID site hijacked to serve malware instead of HWMonitor downloads

CPUID's website was briefly manipulated via a compromised backend component between April 9–10, causing some legitimate download links (e.g., HWMonitor/CPU‑Z) to point to malicious installers; the malware used a fake CRYPTBASE.dll, communicated with command‑and‑control servers, ran largely in memory (via PowerShell), compiled and injected a .NET payload, and showed behavior consistent with credential theft and reuse of infrastructure seen in earlier campaigns. CPUID reports original signed builds were not altered and the issue has been fixed, but scope and initial access details remain unknown.