Signed CPUID Installers Delivered Malware via DLL Sideloading
CPUID’s official website was compromised to serve trojanized installers for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor that included a malicious DLL. The attackers did not alter the signed executables but added a malicious cryptbase.dll loaded via DLL sideloading, bypassing signature verification and infecting users worldwide. This breaks the assumption that verifying digital signatures alone ensures installer integrity.
The compromise lasted about six hours from April 9 to 10, during which the website randomly redirected users to malicious download links. Kaspersky identified over 150 victims across sectors including manufacturing, retail, telecommunications, and education, with infections concentrated in Brazil, China, and Russia. The malware deployed was the STX RAT, capable of stealing browser credentials, cryptocurrency wallets, and FTP passwords.
This incident shows that supply chain attacks can evade signature-based defenses by injecting malicious DLLs alongside legitimate signed binaries. The risk persists because users and organizations relying solely on signature checks may still execute compromised installers that load malicious code at runtime. Supply chain trust assumptions must be reevaluated to address DLL sideloading threats.