Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

STX RAT trojanized CPU-Z and HWMonitor distribution

Malware Activity
First reported
Last updated
Happening score
H score 22
1 unique sources, 1 articles

Summary

Hide ▲

A trojanized CPU-Z and HWMonitor distribution pushed STX RAT through DLL side-loading, exposing downloaders to remote access and infostealing risk. The payload chain used a malicious CRYPTBASE.dll after anti-sandbox checks and external-server contact. The activity was tied to more than 150 victims, mostly individuals, with infections reported in Brazil, Russia, and China.

Related Happenings

Daemon Tools Lite trojanized installer campaign

Campaign
First: 07.05.2026 12:30 Last: 07.05.2026 12:30 Sources 1

About this happening: A **trojanized Daemon Tools Lite installer campaign** is driving **several thousand infection attempts** across **more than 100 countries**, turning a trusted download into a malw...

Open Happening

DAEMON Tools Lite trojanized installer wave

Exploitation Wave
First: 06.05.2026 19:43 Last: 06.05.2026 19:43 Sources 1

About this happening: Trojanized **DAEMON Tools Lite** installers backdoored **thousands of systems** in **more than 100 countries**, turning a trusted download path into a broad infection wave. The co...

Open Happening

DAEMON Tools trojanized-installer stealer and backdoor activity

Malware Activity
First: 05.05.2026 22:21 Last: 05.05.2026 22:21 Sources 1

About this happening: A **DAEMON Tools** supply-chain compromise is delivering **trojanized installers** that install a **backdoor** and steal system data from downloaded systems. The activity has run...

Open Happening

QUIC RAT delivered through compromised DAEMON Tools installers

Malware Activity
First: 05.05.2026 19:07 Last: 05.05.2026 19:07 Sources 1

About this happening: A follow-on **QUIC RAT** payload was delivered through compromised **DAEMON Tools installers**, extending the supply-chain intrusion into **remote access** on a small subset of in...

Latest development: 07.05.2026 12:30

Disc Soft released malware-free Daemon Tools Lite Version 12.6 on May 5 after being notified of the supply chain attack on its build environment, and the affected 12.5.1 build was removed from distribution so users could move to the cleaned release.

Open Happening

AVB Disc Soft hit by network compromise

Incident
First: 05.05.2026 19:07 Last: 05.05.2026 19:07 Sources 1

About this happening: **DAEMON Tools** suffered a **supply-chain compromise** when **official installers** were **trojanized**, enabling malicious payload delivery and raising the risk of downstream in...

Latest development: 07.05.2026 12:30

Disc Soft released the malware-free Version 12.6 of Daemon Tools Lite on May 5 after being notified of the supply chain attack, removed the affected 12.5.1 package from support, and said the incident was contained after isolating affected systems, removing compromised files from distribution, auditing the build and release pipeline, rebuilding and validating installation packages, and strengthening internal security controls and monitoring.

Open Happening

Timeline

  1. 12.04.2026 08:54 1 articles · 1mo ago

    cpuid[.]com download links start redirecting to malicious sites

    Exploitation Observed

    Unknown threat actors compromised cpuid[.]com and replaced CPU-Z and HWMonitor installer download URLs with links to malicious websites, beginning a short watering-hole window that redirected users away from legitimate hardware-monitoring downloads.

    Show sources
    Open in new tab
  2. 12.04.2026 08:54 2 articles · 1mo ago

    Trojanized CPU-Z and HWMonitor installers deliver STX RAT

    Technical Analysis Update

    Trojanized CPU-Z and HWMonitor packages were delivered as ZIP archives and standalone installers containing a legitimate signed executable plus a malicious CRYPTBASE.dll that used DLL side-loading, contacted an external server, performed anti-sandbox checks, and deployed STX RAT.

    Show sources
    Open in new tab
  3. 12.04.2026 08:54 1 articles · 1mo ago

    CPUID confirms the breach and Kaspersky reports victim scope

    Initial Disclosure

    CPUID publicly confirmed the breach as a compromise of a secondary feature or side API that caused the main site to display malicious links, and Kaspersky reported more than 150 victims, mostly individuals, with infections in Brazil, Russia, and China and additional impact on retail, manufacturing, consulting, telecommunications, and agriculture organizations.

    Show sources
    Open in new tab