TLDR Tech / InfoSec
CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads
Unknown threat actors breached cpuid.com for roughly 19 hours (April 9–10) via a compromised side API, replacing CPU-Z and HWMonitor download URLs with links to malicious sites serving trojanized installers that bundled CRYPTBASE.dll for DLL sideloading. The malicious DLL performed anti-sandbox checks before deploying STX RAT, an HVNC-capable infostealer supporting in-memory EXE/DLL/PowerShell/shellcode execution and reverse-proxy tunneling, using C2 infrastructure reused from a prior trojanized FileZilla campaign. Kaspersky identified 150+ victims across Brazil, Russia, and China.
Read the full story