CPU-Z & HWMonitor, cpuid.com, Watering Hole Attack

On April 9, 2026, the cpuid.com website was compromised in a watering hole attack lasting approximately 19 hours. Download URLs for legitimate system administration tools CPU-Z, HWMonitor, HWMonitor Pro, and Perfmonitor 2 were replaced with links to malicious sites distributing trojanized versions. The malicious installers contained legitimate signed executables paired with DLL files named CRYPTBASE.dll that exploited DLL sideloading for C2 communication and payload delivery. Attackers reused infrastructure and code from a March 2026 fake FileZilla campaign, including the STX RAT as the final payload. Over 150 victims were identified globally, primarily individuals but including organizations in retail, manufacturing, consulting, telecommunications and agriculture sectors. The attack demonstrated poor operational security with reused indicators enabling rapid detection.

• Trojanized Claude Code Extension Plants an SSH BackdoorCampaign2026-10-30
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMalware2026-10-23
• Midnight Mimosa Malware Campaign Exploits Android Firmware Supply ChainMalware2026-10-20
• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07