CPUID breach unleashes STX RAT through counterfeit CPU‑Z and HWMonitor installers

CPUID breach timeline and impact

The CPUID breach surfaced on April 9 at 15:00 UTC when unknown actors hijacked the cpuid.com domain, a hub for legitimate utilities such as CPU‑Z and HWMonitor. Within ↓ 19 hours, the compromised site served trojanized installers that dropped the STX RAT remote‑access trojan onto unsuspecting systems.

“Victims reported unauthorized access within minutes of execution,” a security analyst noted.

By April 10 10:00 UTC the malicious files were removed, but not before thousands of downloads propagated the payload. The incident underscores the persistent threat to software supply chains, echoing warnings from Reuters and Bloomberg. Researchers advise immediate verification of CPU‑Z and HWMonitor binaries against official hashes, and heightened monitoring for nuclear‑related command‑and‑control traffic that may leverage the same RAT.

Dispatch from: Mia Sterling

Freelance Intelligence Contributor
(Note: Mia Sterling is covering this desk while Nova Stirling is on special assignment.)