GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe

• Trusted‑source Illusion: Even when a link seems to point to a reputable platform such as GitHub, the underlying URL can be manipulated to resolve to a counterfeit site.
• Ad‑driven Redirection: Paid search and display ads can be weaponized by bad actors to distribute malicious payloads at scale, misleading users who rely on search engines for discovery.
• Privilege Escalation: Once the malicious payload is executed by the user, it gains administrative rights, enabling further lateral movement and persistence.
• Malware Uniqueness:

1. The initial installer is a 128 MB MSI file that mimics the legitimate GitHub Desktop installer but contains over 100 dummy executables to inflate size and evade sandbox limits.
2. The installer employs a GPU‑gated decryption routine: an OpenCL™ kernel derives the AES key only on machines with a real GPU, whose device name is at least ten characters long, causing the payload to remain encrypted in headless analysis environments. (A headless environment is where the front-end or user interface of an application (the “head”) has been decoupled from the back-end services, allowing each to be developed and operated separately.)
3. The GPU-based decryption mechanism suggests the attackers are targeting systems with specific hardware configurations, potentially focusing on users involved in development, gaming, or cryptocurrency mining activities.

• Campaign Goals: We believe the goal of this campaign was to gain initial access to organizations for the purposes of malicious activity such as credential theft, infostealing and ransomware deployment, by misleading IT workers (who often have higher level of network access) into downloading malware while attempting to install GitHub Desktop.
• Geography and Industries Targeted: The campaign we observed targeted users in Western Europe, in the Information Technology industry.
• Attribution: The threat actors behind this campaign have native Russian language proficiency, as demonstrated by PowerShell script comments written in Russian.