--- title: how does this keep happening? (CPU-Z hacked) | daily.dev description: CPU-Z and HWMonitor (by CPUID) were compromised in a supply chain attack between April 3–10, where download links on the official site were silently replaced... canonical: https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: how does this keep happening? (CPU-Z hacked) | daily.dev og:description: CPU-Z and HWMonitor (by CPUID) were compromised in a supply chain attack between April 3–10, where download links on the official site were silently replaced... og:url: https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau og:image: https://api.daily.dev/og/posts/ePlSMmGaU.png og:image:alt: how does this keep happening? (CPU-Z hacked) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # how does this keep happening? (CPU-Z hacked) **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 10 min read · 0 upvotes · 0 comments ## Summary CPU-Z and HWMonitor (by CPUID) were compromised in a supply chain attack between April 3–10, where download links on the official site were silently replaced with links to a Cloudflare R2 bucket serving trojanized executables. The malicious installer dropped a DLL sideloading chain using NTDLL/.NET in-memory execution to communicate with a C2 server on a high non-standard port (31415). Red flags included Russian-language installer dialogs and a mismatched filename. The attack was caught within days by Reddit users noticing the wrong tool was delivered. The likely initial access vector was an outdated Apache version with known CVEs (including a mod_rewrite path traversal) that allowed attackers to modify download link config files. The same infrastructure and DLL sideloading technique was previously used in a trojanized FileZilla campaign, suggesting a persistent threat actor using multi-jurisdictional infrastructure (Chinese registrar, Caribbean hosting) to complicate attribution and law enforcement response. Defenders can use published Snort/YARA signatures and IOCs to check for compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fake Google and Cloudflare verification pages spread multiple malware families](https://daily.dev/posts/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families-8s8xqrwfw) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#apache](https://daily.dev/tags/apache) [View this post on daily.dev](https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"how does this keep happening? (CPU-Z hacked)","url":"https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau"},"datePublished":"2026-04-14T16:36:34.508Z","dateModified":"2026-04-14T16:36:55.712Z","description":"CPU-Z and HWMonitor (by CPUID) were compromised in a supply chain attack between April 3–10, where download links on the official site were silently replaced...","image":"https://i.ytimg.com/vi/WBgdAkol0VQ/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/WBgdAkol0VQ/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-does-this-keep-happening-cpu-z-hacked--eplsmmgau","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,apache","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"how does this keep happening? (CPU-Z hacked)","description":"CPU-Z and HWMonitor (by CPUID) were compromised in a supply chain attack between April 3–10, where download links on the official site were silently replaced...","thumbnailUrl":"https://i.ytimg.com/vi/WBgdAkol0VQ/sddefault.jpg","uploadDate":"2026-04-14T16:36:34.508Z","duration":"PT10M","url":"https://api.daily.dev/r/ePlSMmGaU","embedUrl":"https://www.youtube.com/embed/WBgdAkol0VQ"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"how does this keep happening? (CPU-Z hacked)"}]} ```