They Hacked CPU-Z -- Were You Infected?

Summary — CPU‑Z / Hardware Monitor supply‑chain compromise

What happened

• Between April 9–10 there was a 16‑hour window during which the official CPU‑Z and Hardware Monitor downloads on their website were hijacked and served malware.
• Both the installer and the portable (ZIP) distributions were affected. The site links pointed to fake files on an attacker server — this was not an intentional malicious release by the original developers.

Technical attack details

• Installer vector
  • The compromised installer downloaded a file named HWiNFO_Monitor_Setup.exe (HWiNFO is a different tool) and displayed a Russian installer UI. The foreign UI was a visible indicator if you ran it.
• Portable (ZIP) vector
  • Attackers used DLL hijacking / sideloading. The legitimate, signed CPU‑Z EXE was included in the ZIP, but a malicious cryptbase.dll was placed alongside it.
  • Because Windows searches the EXE folder first for DLLs, the application loaded the fake cryptbase.dll instead of the system one. That DLL then fetched and executed additional malware.
• Note on code signatures
  • The EXE’s code signature could appear valid, so checking the EXE signature alone might not reveal the compromise.

Malware behavior and impact

• The payload is a sophisticated remote‑access trojan (RAT) capable of:
  • Giving attackers interactive control of the machine.
  • Installing persistent startup components that survive reboots.
  • Exfiltrating data, including Google Chrome credentials.
• Persistence means an initial run can leave hidden processes and components that remain after reboot.

Indicators of compromise (IoCs)

Check for:

• Having downloaded or run the Russian‑language installer during the April 9–10 window.
• Finding a cryptbase.dll file in the downloaded CPU‑Z / Hardware Monitor ZIP or located next to the EXE.
• Unexpected persistent processes, credential theft, or other suspicious behavior after installing those tools in the affected timeframe.

Recommended remediation

• Treat an infected machine as fully compromised.
  • Recommended action: wipe/reformat Windows and reinstall from clean media.
• Before reinstalling:
  • Disconnect the drive from the internet.
  • Copy only essential personal files while offline — preferably by mounting the drive externally so it cannot boot.
  • Scan backups on a separate, known‑clean system before restoring.
• If unsure, consider hiring a professional. Power users may be able to perform the steps themselves.

Prevention and lessons

• Supply‑chain attacks can bypass common safety checks (official site links, EXE signatures). DLL sideloading is a notable risk.
• Use real‑time protection (Windows Defender or other antivirus with behavior‑based detection) and consider scanning installers with VirusTotal or similar services.
• Do not rely solely on EXE signatures; DLLs aren’t always signed and can be abused.
• Balance staying up‑to‑date with the potential supply‑chain risk — there is no one‑size‑fits‑all rule for choosing versions.

Product / version notes

• Legitimate versions mentioned: Hardware Monitor v1.63 and CPU‑Z v2.19 — however, the site linked to fake files during the compromise window.

Related resources / tutorials

• The referenced video includes a tutorial explaining DLL hijacking / sideloading (link provided in the original video).

Main speaker(s) / sources

• Narrator / video creator (unnamed in the subtitles).
• Referenced entities and tools: CPU‑Z and Hardware Monitor (official website/statement), observed HWiNFO filename, Windows cryptbase.dll behavior, VirusTotal, Windows Defender / antivirus analyses, and independent malware analysts.