CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Threat actors briefly compromised cpuid.com (approx. April 9–10, 2026) to swap legitimate CPU-Z and HWMonitor download links with malicious sites serving trojanized installers and ZIPs that side-loaded a malicious CRYPTBASE.dll, which downloaded and executed STX RAT (HVNC/infostealer). Vendors observed over 150 victims (primarily individuals) across Brazil, Russia, and China, noted reuse of C2 domains and infection chains from a previous fake FileZilla campaign, and confirmed legitimate signed binaries themselves were not altered.