Mike
36.7K posts

Mike
@mstefan
Grumpy old man who writes code. Believer in science, objective reality and human rights. The Earth is an oblate spheroid. Emojis in Unicode are a blight.
Southern California Katılım Mart 2008
998 Takip Edilen1.1K Takipçiler

@MattLawrenceArt @latinxiscringe @pirooooon3 Used to be diacetyl, safe to eat, not so safe to inhale.
English

@latinxiscringe @pirooooon3 "Butter" is right 😂 Whatever that chemical cocktail is, it has absolutely nothing to do with butter
English
Mike retweetledi

Yeah, so pretty much this cpuid.com malware is a pain in the ass. I'd have to spend a good bit of time trying to bonk it with a stick and reconstruct some of it. Whoever developed this malware actually cares about evasion and made some intelligent decisions when developing this malware payload.
This appears to only impact HWMonitor 64bit. It appears (based on user reports) cpuid became malicious around 7PM EST, April 10th, 2026. However, it is possible it was much earlier than this, this is just when people began noticing and discussing it online.
From an extremely high-level overview, it appears the ultimate goal of this malware is data theft, specifically browser credentials. However, I could be wrong in that assessment, but I'm fairly confident in it. I'm guessing this is the end goal because when I emulated it I can see it messing with Google Chrome's IElevation COM interface (trying to dump and decrypt saved passwords). However, between this it does a bunch of other stuff too.
1. They (an unknown Threat Actor) compromised cpuid.com to deliver malware from HWMonitor. It impacts the actual installer as well as the portable installer. It downloads stuff from supp0v3-dot-com, the same domain used from a previous malware campaign targeting FileZilla in the beginning of March, 2026 initially reported by MalwareBytes.
2. HWMonitor comes packaged with a malicious CRYPTBASE.dll. CRYPTBASE.dll is a legitimate Windows library, but they made a fake one to blend in (malware masquerading). This DLL is responsible for connecting to their C2 and downloading the other malware stages.
3. It tries to detect emulation and prevent reverse engineering by checking for the presence of specific registry keys on the machine. However, they failed doing this and didn't account for everything. Notably, they only check for VirtualBox (whomp, whomp).
4. It downloads a .cs file from a remote C2 and then compiles it manually on the machine by invoking .NET stuff. This is an interesting strategy. It does all of this via Powershell (LOLBIN nonsense).
5. The .cs file it compiles is a .NET binary with NTDLL exports. The main HWMonitor binary performs process injection using this compiled .NET binary. This is an interesting strategy.
6. Almost everything it does is performed in-memory. I would have to do through this and manually bonk all of this stuff with a stick and determine precisely how it operates. However, I don't think that is necessary because at this point we know this is malware and we know it's trying to steal browser credentials.
+2 points for IElevation COM Interface credential dumping
+1 point for inline Powershell CLI DLL compilation
+1 point for .NET assembly NTDLL export proxying
-1 point for botched anti-emulation
+2 points for website compromise and supply chain attack
+1 point for memory persistence
-3 points for recycling the same C2 from March, 2026 campaign
Overall I give this malware a B-. This is pretty good malware.

English

@UK_Daniel_Card jeebus christmas, what weird times we find ourselves mired in
English

Pitt Bros Steak Frites Toastie? Yes/No
Soulfood@Soulfoodiiee
🍽 Pitt Bros Steak Frites Toastie 👨🏻🍳 Tom Murray | Bitta Banging 📝 Recipe Link In The Comments
English

@sevdaloji What's funny is the app first said your post was translated from Japanese, but read as perfect English. When I clicked on it, it "fixed" itself to say translated from Turkish. A minor bug, but so far it's fairly impressive.
English

@ai_for_success It reads like it's been written in English. Impressive stuff.
English

@Jackywine @elonmusk Let's work on keeping people alive on our moon for a few weeks before talking about Mars, or Dyson spheres. 🙄
English

@dogsmellsgood Only 14-16%? I assumed it was something anyone could do. Now I'm feeling special.
English

I’m not sure the point in this; it just stops a lot of people seeing eff content. Makes zero sense to me.
EFF@EFF
After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue. 🧵(1/5)
English

@mistressdivy I scroll X and Reddit, inevitably come across various relationship posts, which makes me happy that I don't have a wife or girlfriend.
English

@davepl1968 @_jameshatfield_ I think that's it, exactly. Our educational system is a relic of the industrial age where the goal was to teach kids how to be obdeient, efficient factory workers (right down to the ringing bells telling kids when there's a "shift" change and its time for their next class.)
English

That's kind of my point - that SOME kids will really flourish in certain tasks. Computers are one of them. Music is another. Drafting. Acting. Math. Whatever.
But if you don't expose them to it, it shows up.
I don't see the educational system so much as a Marxist thing as a relic of the factory/industrial/military system that needed a steady supply of fresh recruits.
If we knew how to do it well, we should split kids into different tracks based on their abilities/interests. Not sure that we know how, though.
English

I taught the elementary kids' computer lab at the local elementary school for about ten years. By about fourth grade, the kids vary widely in PC ability.
You'll have one kid porting Doom and one kid crying because CAPS LOCK is on and he can't log in. One kid trying to eat toner while another fixes the projector.
A lot of that is comfort - you can tell some kids use a PC at home a great deal while others have seemingly no exposure.
Does it matter? No idea! I understand limiting screen time and so on, but sometimes kids who genuinely have a knack for it are being held back by good intentions!
When I sold my company, we donated all the extra PCs and monitors to the school... a couple of dozen Dell Dimension 4200s and so on. Absolutely required for any mid-2000s computer lab!
Cigarette Nostalgia@CigsMake
The kids today don’t know the dopamine rush of going to the computer lab
English

a woman accidentally said “fuck” in a grocery store after dropping her phone and a kid standing behind her repeated it instantly.
she turned around absolutely horrified ready to apologize and the mother was crying.
her son is nonverbal and 10 years old and just said his first word ever. the word was fuck. they got invited to a pool party.
this is the most beautiful and chaotic story i have read this week.😭
English

Imagine relying on Microsoft products in space lolololol
Latest in space@latestinspace
#NEWS 🚨: Artemis II crew experienced issues with Outlook this morning and had to ask ground crew for assistance "We have two Microsoft Outlooks and neither one is working"
English

@vee_dimple @luxemiaa It's just the natural result of his two functioning brain cells fighting for third place.
English















