(Credit: CPUID)
If you downloaded the free PC-monitoring tools CPU-Z or HWMonitor yesterday, you may have actually installed malware after a hacker briefly hijacked the downloads to deliver a Trojan.
On Thursday, Reddit users began warning about the threat, which involves CPUID.com, the official site that hosts downloads for the tools.
A user reported updating their HWMonitor installation, which can monitor your PC’s voltage and temperature levels. The download from CPUID.com delivered “HWiNFO_Monitor_Setup.exe," which Windows Defender flagged as a virus. Initially, the user ignored the warning, but then noticed “a Russian install program opening” during the installation process and canceled it.
The finding suggests CPUID.com was compromised in some fashion—specifically, HWMonitor version 1.63—prompting other users and security researchers to investigate.
Vx Underground, which catalogs malware, examined CPUID.com and confirmed that it began spreading malware at about 7 p.m. EST on Thursday. “From an extremely high-level overview, it appears the ultimate goal of this malware is data theft, specifically browser credentials,” Vx Underground said, noting that both HWMonitor and CPU-Z downloads were changed. The malware also bypassed some antivirus software.
The attack indicates that a hacker saw a major opportunity in targeting CPU-Z and HWMonitor, which have been downloaded hundreds of thousands of times across other third-party sites. But it looks like the malicious downloads only circulated on CPUID.com for six hours, according to a tweet from Samuel Demeulemeester, the developer of CPU-Z.
“Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links (our signed original files were not compromised). The breach was found and has since been fixed,” he wrote.
It's unclear how the hacker gained access. In the meantime, Vx Underground says the malware used in the attack shares a command-and-control server with another scheme spotted last month involving a look-alike FileZilla site hosting a Trojanized copy of the software.