CPU-Z and HWMonitor official download links hijacked, malware included
For the past few years, there have been warnings online that software should always be downloaded from trusted sources - and preferably from the developers' own websites.
But even this advice doesn't always help.
The official website for HWMonitor and CPU-Z, hugely popular programs among PC enthusiasts, was successfully hijacked. Both programs are developed by the same company, CPUID, and both programs are available for download through the same site.
The perpetrators who hijacked the site did not cause any easily noticeable damage to the sites; instead, they only changed the official download links for both programs to point to fake download files containing malware. The issue came to light when users who had downloaded the programs started complaining on social media about how antivirus software completely freaked out over recently downloaded CPU-Z or HWMonitor. Some users also contacted CPUID directly.
CPUID managed to rectify the situation six hours after the site's download links were changed to point to installation files containing malware. However, users who downloaded either program from its official site between April 9, 2026, and April 10, 2026, also received malware on their computers as a bonus with the program. According to the company's statement (X/Twitter), the incident was caused by a vulnerability in CPUID's API interface, which attackers successfully exploited.

Most people are likely well aware that Signal is one of the most strongly encrypted instant messaging apps available.




