🚨 do you understand what just happened to your passwords
cpuid one of the most trusted sites in PC hardware.
hacked. April 10th, 2026. CPU-Z and HWMonitor. both compromised.
> fake CRYPTBASE.dll ships inside the installer
> connects to C2, downloads a C# file
> compiles it silently using YOUR own Windows tools
> injects into memory. never touches disk. AV sees nothing.
> opens Chrome's password vault. dumps everything.
the chain:
cpuid → HWMonitor installer → DLL hijack
→ supp0v3[.]com → silent .NET compile
→ in-memory injection → Chrome credentials stolen
same group. same C2 domain. hit FileZilla in March 2026.
they got lazy. that's the only reason we caught it.
Mr. Titus Tech is correct. cpuid-dot-com is indeed delivering malware right now.
As I began poking this with I stick I discovered this is not your typical run-of-the-mill malware. This malware is deeply trojanized, distributes from a compromised domain (cpuid-dot-com), performs file masquerading, is multi-staged, operates (almost) entirely in-memory, and uses some interesting methods to evade EDRs and/or AVs such as proxying NTDLL functionality from a .NET assembly.
The C2 domain present in one of the binaries is a clear IoC. This is the same Threat Group who was masquerading FileZilla in early March, 2026. They've been busy.