CPUID watering hole attack spreads STX RAT malware

CPUID's website was briefly compromised to serve trojanized CPU‑Z and HWMonitor installers that used DLL sideloading (malicious CRYPTBASE.dll) to deliver the STX RAT. Kaspersky reported the April 9–10, 2026 campaign, linked reused C2/configuration from a previous fake FileZilla operation, and published indicators after identifying about 150 victims in multiple countries.