Hackers hijacked CPUID downloads, served STX RAT to victims

CPUID's website was briefly compromised (April 9–10), causing legitimate download links for utilities like CPU-Z and HWMonitor to redirect to trojanized packages hosted on malicious Cloudflare R2 buckets; those installers contained a malicious CRYPTBASE.dll that used DLL sideloading, anti-sandbox checks, and C2 communication to deploy the STX RAT, which steals browser credentials, crypto-wallets, and FTP credentials — researchers identified ~150 victims (individuals and organizations) and advised checking downloads, DNS logs, and cleaning/credential resets if compromised.