{"id":14761,"date":"2025-09-09T13:23:25","date_gmt":"2025-09-09T13:23:25","guid":{"rendered":"https:\/\/newestek.com\/?p=14761"},"modified":"2025-09-09T13:23:25","modified_gmt":"2025-09-09T13:23:25","slug":"smart-gpugate-malware-exploits-github-and-google-ads-for-evasive-targeting","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14761","title":{"rendered":"Smart GPUGate malware exploits GitHub and Google Ads for evasive targeting"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Security researchers at Arctic Wolf have uncovered a novel malware campaign targeting users in Western Europe, delivered through Google Ads and employing sophisticated evasion techniques.<\/p>\n

Dubbed GPUGate, the campaign uses malicious GitHub Desktop installers to distribute its payload masquerading as legitimate software. Attackers are using trusted platforms to bypass traditional detection methods and lure users into downloading the malware.<\/p>\n

\u201cOn 19 August 2025, a threat actor leveraged GitHub\u2019s repository structure together with paid placements on Google Ads to funnel users toward a malicious download hosted on a lookalike domain,\u201d Arctic Wolf researchers said in a blog post. \u201cBy embedding a commit\u2011specific link in the advertisement, the attackers made the download appear to originate from an official source, effectively sidestepping typical user scrutiny.\u201d<\/p>\n

GPUGate\u2019s operators were also seen incorporating advanced evasion techniques, most notably a GPU-based decryption process that ensures the malware only activates on systems with specific graphics hardware.<\/p>\n

<\/a>Malicious Ads Masquerading as GitHub Desktop<\/h2>\n

Arctic Wolf\u2019s Cybersecurity Operations Center (cSOC) spotted the malware being distributed via Google ads that directed users to compromised GitHub repositories. These ads were carefully crafted to look legitimate, using commit-specific links that mimicked genuine GitHub workflow. Once users clicked, they were redirected to fake domains hosting a malicious GitHub Desktop installer.<\/p>\n

The ads were designed to promote a \u201cGitHub Desktop\u201d installer or related GitHub tools, making them appear as legitimate software downloads. This approach allowed the attackers to exploit the credibility of both GitHub and Google ads, bypassing basic scrutiny and increasing the likelihood of a download.<\/p>\n

Researchers warned <\/a>that the campaign aimed to infiltrate organizations by tricking IT personnel\u2013who typically have elevated network privileges\u2013into downloading malware under the guise of installing GitHub desktop, potentially enabling credential theft<\/a>, information exfiltration, and even ransomware deployment.<\/p>\n

\u201cOnce the malicious payload is executed by the user, it gains administrative rights, enabling further lateral movement and persistence,\u201d the researchers said.<\/p>\n

<\/a>GPU-Gated decryption evades detection<\/h2>\n

The malware itself is delivered as a large Microsoft Software Installer (MSI) file, approximately 128 MB in size. It features a GPU-gated decryption mechanism that keeps the payload encrypted unless it detects the presence of a real GPU on the system. Researchers noted that this design allows GPUGate to remain dormant in virtual machines, automated analysis environments, or less powerful machines, making it extremely difficult for security researchers to analyze.<\/p>\n

Once activated, the malware launches PowerShell<\/a> with parameters designed to bypass Windows execution policies while hiding its windows from user view. Additionally, persistence is achieved through a scheduled task running with the highest administrative privileges, allowing it to survive reboots and operate across user sessions.<\/p>\n

The campaign also targets macOS devices, distributing AMOS Stealer<\/a> (also known as Atomic Stealer) via a tailored installer that matches either x64 or ARM processors. This info-stealer, sold as malware-as-a-service on underground forums, can exfiltrate a wide range of sensitive data, including keychain passwords, VPN profiles, browser credentials, instant messaging data, documents, and cryptocurrency wallets.<\/p>\n

Researchers noted that the inclusion of cross-platform attacks demonstrates the operator\u2019s aim for comprehensive, persistent access across diverse enterprise environments. \u201cThe malvertising and geofencing used are customized to specifically target EU countries,\u201d they added. \u201cThe industries we observed directly targeted included workers in the Information Technologies sector.\u201d For protection, Arctic Wolf recommends combining runtime inspection with sandboxing as well as boosting user awareness, as GPUGate\u2019s advanced evasion and convincing mimicry make static defenses insufficient.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Security researchers at Arctic Wolf have uncovered a novel malware campaign targeting users in Western Europe, delivered through Google Ads and employing sophisticated evasion techniques. Dubbed GPUGate, the campaign uses malicious GitHub Desktop installers to distribute its payload masquerading as legitimate software. Attackers are using trusted platforms to bypass traditional detection methods and lure users into downloading the malware. \u201cOn 19 August 2025, a threat… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14761","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14761"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14761\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}