CPUID website allegedly hacked: users report HWMonitor and CPU

CPUID confirms its website has been compromised. Downloading HWMonitor and CPU-Z, popular Windows utilities, infected some users with malware.

Update: The CPUID website was compromised for a few hours to deliver malware.

“Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9th and April 10th, causing the main website to randomly display malicious links (our signed original files were not compromised). The breach was found and has since been fixed,” Samuel Demeulemeester told Cybernews .

“It looks like they waited until Franck was on leave before launching the attack”

Franck Delattre is the creator of CPU-Z and the founder of CPUID.

Demeulemeester apologizes for the inconvenience.

“I did my best to fix that mess as soon as possible.”

CPUID is a French software company behind popular hardware information and monitor tools to track temperatures, voltages, fan speeds, power, and other parameters.

Its website, which hosts the apps, is unavailable at the time of writing.

Initial reports the suspected cyberattack began to surface Thursday evening, around 9 p.m. UTC.

“I checked in the application if there was any update, and yes. The application told me to update to 1.63. I clicked on update, and the official CPUID page opened. I followed the page to download the latest version. The file was called ‘HWiNFO_Monitor_Setup.exe.’ After the download, my Windows Defender instantly detects a virus,” a user reported.

They checked the update file on VirusTotal, an online service that scans files and links for malware, and it confirmed that the file is malicious, flagged by at least 32 security vendors as trojan.

Chris Titus, a tech content creator and creator of a popular Windows debloating utility, shared reports on two compromised utilities, CPU-Z and HWMonitor.

“Millions to be PWNED!” the YouTuber warned.

It appears that the website compromise is the reason why some users are getting malicious downloads.

“ALERT: The CPUID website that hosts HWMonitor, CPU-Z, and other software has been hacked and was redirecting to infected installers – this also affected updates made through both software,” warned Renan Maniero, a technology enthusiast.

Malware analysts at vx-underground confirmed the compromise, noting that the multi-staged malware is distributed from a compromised domain (cpuid.com), is deeply trojanized, operates almost entirely in memory, and uses "interesting methods” to evade detection. The command-and-control center domain is hardcoded in one of the binaries.

CPUID develops CPU-Z, HWMonitor, HWMonitor PRO, PerfMonitor 2, and powerMAX applications.

Security experts warn users to avoid running unverified installers and to verify hashes before downloading or updating any affected applications.

If the malware has been installed, users should assume compromise and their sensitive data, such as passwords or crypto wallets, might be at risk, requiring them to rotate the credentials and clean the device. As a precaution, review activity on important accounts and check that multi-factor authentication is enabled.

Updated on April 10th [08:30 a.m. GMT] with a from CPUID.

Unlock more exclusive Cybernews content on YouTube.