Executive Summary
On April 9, 2026, the official CPUID website was compromised at the API level for approximately 19 hours, redirecting legitimate download requests for tools like CPU-Z to attacker-controlled infrastructure. This supply chain attack delivered properly signed binaries bundled with a malicious payload, targeting high-value users such as IT administrators and security engineers to facilitate initial access brokerage.
The attack utilized STX RAT, a remote access trojan capable of hidden VNC sessions, credential theft, and cryptocurrency wallet interception. Despite the sophisticated delivery method, the adversary demonstrated poor operational security by reusing command-and-control (C2) infrastructure previously identified in campaigns targeting FileZilla and NPM maintainers.
This incident highlights a critical shift in adversary tradecraft where trusted vendor distribution channels are subverted. Organizations must move beyond signature-based trust and implement behavioral monitoring at the point of execution to detect anomalies in signed, 'trusted' software.