{"id":569,"date":"2026-04-12T06:05:05","date_gmt":"2026-04-12T06:05:05","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=569"},"modified":"2026-04-12T06:05:05","modified_gmt":"2026-04-12T06:05:05","slug":"cpuid-breach-distributes-stx-rat-via-trojanized-cpu-z-and-hwmonitor-downloads","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=569","title":{"rendered":"CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 12, 2026<\/span><\/span>Malware \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Unknown threat actors compromised CPUID (\u00abcpuid[.]com\u00bb), a website\u00a0that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX\u00a0RAT.<\/p>\n

The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00\u00a0UTC, with the download URLs for CPU-Z and HWMonitor installers replaced with links to malicious\u00a0websites.<\/p>\n

In\u00a0a post<\/a> shared on X, CPUID confirmed the breach, attributing it to a compromise of a \u00absecondary feature (basically a side API)\u00bb that caused the main\u00a0site to randomly display malicious\u00a0links. It’s worth noting that the attack did not impact its signed original\u00a0files.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According\u00a0to Kaspersky<\/a>, the names of the rogue websites are as follows\u00a0–<\/p>\n