CryptLoad Lab

In April 2026, threat actors compromised the distribution channel of CPU-Z, a popular hardware information utility, and bundled a trojanized CRYPTBASE.dll alongside the legitimate installer. When users launch cpu-z.exe, Windows loads the malicious DLL from the application directory before checking System32, silently activating the attack chain while the application runs normally. The malicious DLL acts as a proxy - forwarding all legitimate API calls to the real system library so nothing appears broken. In the background, it decodes an embedded payload from the .rdata section and reflectively loads a full-featured backdoor DLL entirely in memory, never writing it to disk....