If you downloaded the free PC-monitoring tools CPU-Z or HWMonitor yesterday, you may have actually installed malware after a hacker briefly hijacked the downloads to deliver a Trojan.
On Thursday, Reddit users began warning about the threat, which involves CPUID.com, the official site that hosts downloads for the tools.
A user reported updating their HWMonitor installation, which can monitor your PC’s voltage and temperature levels. The download from CPUID.com delivered “HWiNFO_Monitor_Setup.exe,” which Windows Defender flagged as a virus. Initially, the user ignored the warning, but then noticed “a Russian install program opening” during the installation process and canceled it.
The finding suggests CPUID.com was compromised in some fashion—specifically, HWMonitor version 1.63—prompting other users and security researchers to investigate.
Vx Underground, which catalogs malware, examined CPUID.com and confirmed that it began spreading malware at about 7 p.m. EST on Thursday. “From an extremely high-level overview, it appears the ultimate goal of this malware is data theft, specifically browser credentials,” Vx Underground said, noting that both HWMonitor and CPU-Z downloads were changed. The malware also bypassed some antivirus software.
The attack indicates that a hacker saw a major opportunity in targeting CPU-Z and HWMonitor, which have been downloaded hundreds of thousands of times across other third-party sites. But it looks like the malicious downloads only circulated on CPUID.com for six hours, according to a tweet from Samuel Demeulemeester, the developer of CPU-Z.
“Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links (our signed original files were not compromised). The breach was found and has since been fixed,” he wrote.
It’s unclear how the hacker gained access. In the meantime, Vx Underground says the malware used in the attack shares a command-and-control server with another scheme spotted last month involving a look-alike FileZilla site hosting a Trojanized copy of the software.
About Our Expert
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how President Trump’s tariffs will affect the industry. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
-
Man Arrested for Throwing Molotov Cocktail at OpenAI CEO’s House
-
In Latest Pivot, Amazon Luna to Drop Game Purchases, Third-Party Stores
-
FCC Router Ban Is Bad News for These Brands. Is Yours on the List?
-
The Death of PC Ownership? Framework Computer CEO Issues Chilling Warning
-
Ad-Free Prime Video Just Got More Expensive, Lower Tier Drops Big Perk
-
More from Michael Kan
