CPUID Website Breach Delivers Malware via Compromised Installers On April 10, 2026, attackers breached the website of CPUID, the developer behind popular system tools HWMonitor and CPU-Z, replacing legitimate download files with malware-laced installers. The compromise was first reported by cybersecurity research group vx-underground, which identified that users attempting to download the latest versions of these tools were instead redirected to a malicious domain (supp0v3[.]com), previously linked to a March 2026 malware campaign. The infected file, disguised as HWiNFO_Monitor_Setup.exe (replacing the legitimate hwmonitor_1.63.exe), deployed malware designed to steal browser credentials, particularly targeting Google Chrome’s IElevation COM interface to extract and decrypt saved passwords. The malware employed advanced evasion techniques to bypass endpoint detection and antivirus systems, indicating a sophisticated supply chain attack. Samuel Demeulemeester, CPUID’s developer, confirmed that a side API was compromised for approximately six hours, during which the malicious files were distributed. While the breach has since been resolved and CPUID’s signed original files remained unaltered, the short window of exposure likely affected numerous users many of whom may have unknowingly installed the malware. Windows Defender reportedly blocked some instances, though users who bypassed warnings could have faced credential theft. This incident follows a rising trend of supply chain attacks, where threat actors target trusted software distribution channels to spread malware. Recent examples include a compromised JavaScript library in March 2026, a hijacked 7-Zip download site in January 2026, and a Notepad++ update server breach in June 2025. The attack underscores the risks of even brief security lapses in widely used tools.