CPUID download links appear compromised, HWMonitor and CPU-Z users report malware
Multiple users on Reddit are warning that downloads served through CPUID’s official pages for HWMonitor and CPU-Z may have been compromised. The reports say the HWMonitor 1.63 update path delivered a file named HWiNFO_Monitor_Setup.exe instead of the expected CPUID package, with Windows Defender flagging it and the installer showing Russian-language prompts.
CPUID’s official product pages currently still list HWMonitor 1.63, released April 3, 2026, and CPU-Z 2.19. The setup buttons on both pages go through CPUID-hosted download pages that then point to download.cpuid.com, while the ZIP links shown on the product pages resolve to a Cloudflare R2 hostname.
Source: Hybrid Analysis
Someone replaced the links
What raised concern is that users and security analysis pages linked the suspicious downloads to a different R2 hostname and filenames that do not match CPUID’s normal naming scheme. Users reported HWMonitor downloads redirecting to the same hostname with the HWiNFO_Monitor_Setup.exe name.
© Eric Parker Until CPUID issues a statement, users should avoid downloading or updating HWMonitor and CPU-Z directly from the official site if the package name, host, or installer behavior looks different from CPUID’s normal files. In this case, mismatched filenames, Defender detections, and redirects to unexpected hosting endpoints are enough to treat the downloads as unsafe.
At the time of writing, the CPUID website was taken down.
Source: Reddit , Hybrid Analysis
Many thanks to HDR for the tip!
