If you downloaded the free PC-monitoring tools CPU-Z or HWMonitor yesterday, you may have actually installed malware after a hacker briefly hijacked the downloads to deliver a Trojan.
On Thursday, Reddit users began warning about the threat, which involves CPUID.com, the official site that hosts downloads for the tools.
A user reported updating their HWMonitor installation, which can monitor your PC’s voltage and temperature levels. The download from CPUID.com delivered “HWiNFO_Monitor_Setup.exe,” which Windows Defender flagged as a virus. Initially, the user ignored the warning, but then noticed “a Russian install program opening” during the installation process and canceled it.
The finding suggests CPUID.com was compromised in some fashion—specifically, HWMonitor version 1.63—prompting other users and security researchers to investigate.
Vx Underground, which catalogs malware, examined CPUID.com and confirmed that it began spreading malware at about 7 p.m. EST on Thursday. “From an extremely high-level overview, it appears the ultimate goal of this malware is data theft, specifically browser credentials,” Vx Underground said, noting that both HWMonitor and CPU-Z downloads were changed. The malware also bypassed some antivirus software.
The attack indicates that a hacker saw a major opportunity in targeting CPU-Z and HWMonitor, which have been downloaded hundreds of thousands of times across other third-party sites. But it looks like the malicious downloads only circulated on CPUID.com for six hours, according to a tweet from Samuel Demeulemeester, the developer of CPU-Z.
Recommended by Our Editors
“Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links (our signed original files were not compromised). The breach was found and has since been fixed,” he wrote.
It’s unclear how the hacker gained access. In the meantime, Vx Underground says the malware used in the attack shares a command-and-control server with another scheme spotted last month involving a look-alike FileZilla site hosting a Trojanized copy of the software.
Get Our Best Stories!
Stay Safe With the Latest Security News and Updates
By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy
Policy.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
About Our Expert
Michael Kan
Senior Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how President Trump’s tariffs will affect the industry. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Read Full Bio
