Hackers Abuse Legitimate HWMonitor Binary to Load Malicious DLL Payload

Cybersecuritynews •Tushar Subhra Dutta • May 14, 2026

Hackers are once again turning familiar tools against the very users who trust them. A new attack campaign has been discovered in which threat actors weaponized HWMonitor, a widely used hardware monitoring utility developed by CPUID, to silently deliver a remote access trojan known as STX RAT. By disguising malware inside what looks like a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HWMonitor Hijacked to Deliver Remote Access Trojan via Malicious DLL Hackers have exploited the HWMonitor utility, a trusted hardware monitoring tool, to deliver a remote access trojan (RAT) known as STX RAT. The attack involves a weaponized ZIP archive that masquerades as a legitimate installer, distributed through a fake download link. Users of HWMonitor, developed by CPUID, are at risk as the malware is designed to operate stealthily once installed. This campaign highlights the ongoing threat of trusted software being misused for malicious purposes. The exact number of affected users is currently unknown, but the potential impact is significant given HWMonitor's popularity among system administrators and tech enthusiasts. Security experts are urging users to verify download sources and remain vigilant against such attacks. The current status of the attack is active, with ongoing investigations into the distribution methods. 2 sources 65

Extracted Entities

Hackers Abuse Legitimate HWMonitor Binary to Load Malicious DLL Payload

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Tools (1)