CPUID Confirms Website Compromise That Redirected Updates to Malware
Summary
CPUID says its website was compromised for about six hours on April 9–10, redirecting software update requests to a trojanized installer. The in-memory info-stealer targeted browser credentials, passwords and crypto wallets; CPUID says it fixed the vulnerability.
Key points
- A secondary API was reportedly compromised, redirecting legitimate CPUID update requests to a malicious domain for about six hours between April 9 and April 10.
- Users attempting to download updates received a trojanized installer, including one named HWiNFO_Monitor_Setup.exe.
- The malware used a fake CRYPTBASE.dll and ran its multi-stage payload in memory.
- The info-stealer allegedly targeted browser credentials, passwords and cryptocurrency wallets.
- The campaign reportedly shared infrastructure with a previous FileZilla campaign.
- CPUID confirmed the incident and said the vulnerability was fixed.
Article Details
- Victim Organization
- CPUID
- Victim Domain
- Unknown
- Incident Type
- Compromise of a secondary API and website used to redirect software update requests to a malicious domain and distribute a trojanized installer.
- Data Types Exposed
- Browser credentials
- User passwords
- Cryptocurrency wallet data
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- For approximately six hours between April 9 and April 10, update requests were redirected and users received a trojanized installer. The distributed malware reportedly ran in memory and deployed an info-stealer. CPUID confirmed the incident and said the vulnerability was fixed. The article describes data as targeted, not confirmed stolen.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe malicious CRYPTBASE.dll reportedly masqueraded as a legitimate Windows library.T1195.002 · Compromise Software Supply ChainThe compromised update mechanism redirected legitimate software update requests to deliver a trojanized installer.T1555.003 · Credentials from Web BrowsersThe distributed info-stealer allegedly targeted browser credentials.
Vendors
Products
CPU-ZCPUID, maker of CPU-Z and HWMonitor, was compromised via a secondary API that redirected legitimate update requests to a malicious domain for about six hours between April 9 and April 10, delivering a trojanizedHWMonitorCPUID, maker of CPU-Z and HWMonitor, was compromised via a secondary API that redirected legitimate update requests to a malicious domain for about six hours between April 9 and April 10, delivering a trojanized