Cybercriminals compromised an API used by CPUID and altered the download links on their official site, distributing harmful software disguised as the popular CPU-Z and HWMonitor applications.

These widely-used tools are utilized by millions to monitor computer hardware health and system specifications.

Users reported on Reddit recently that the official download link instead led to Cloudflare R2 storage and delivered a compromised version of HWiNFO, another hardware diagnostic tool from a different vendor.

The malicious file, named HWiNFO_Monitor_Setup, launches a suspicious Russian installer within an Inno Setup wrapper, a notable deviation from the norm.

Users also noted they could still get the legitimate hwmonitor_1.63.exe directly from the official URL, suggesting the original files weren’t changed, but the provided download links were corrupted.

This manipulated download process was also verified by Igor’s Labs and @vxunderground, who described the attack as involving a sophisticated loader utilizing established hacking methods.

“After initial analysis, it is clearly not typical malware,” vxunderground said.

“This malware is heavily modified with a trojan, is sourced from a compromised website (cpuid-dot-com), disguises itself, is deployed in multiple stages, operates primarily in computer memory, and uses sophisticated techniques to avoid detection from EDR and/or AV, like rerouting NTDLL functionality using a .NET resource.”

The researcher also indicated that the same attacker targeted users accessing the FileZilla FTP program last month, hinting at an ongoing focus on popular software programs.

The downloaded ZIP file is detected by 20 antivirus programs on VirusTotal, although the exact identification is not confirmed. Some identify it as Tedy Trojan, while others label it Artemis Trojan.

Some Virustotal researchers claim the rogue HWiNFO version steals private information.

BleepingComputer has reached out to CPUID for details concerning the nature of the security breach, its timeline, the specific versions affected, and guidance for users. A statement has been provided by a CPUID spokesperson.

The same person also revealed that hackers attacked during the main developer’s absence.

CPUID appears to have resolved the issue, now providing clean copies of CPU-Z and HWMonitor.