Attackers exploited GitHub’s fork system to hijack the official GitHub Desktop repository, pushing malware disguised as legitimate installers. Dubbed “GPUGate,” this campaign delivers HijackLoader through a multi-stage chain.
First detailed in a Japanese report by GMO Cybersecurity by Ierae, Inc., the threat persists despite GitHub’s awareness since September 2025. Researchers Theo Webb revisited it, uncovering OpenCL tricks to evade analysis.
Key Takeaways
- Campaign peaked September-October 2025, targeting EU/EEA and Japan via malvertising for developer tools.
- Abuses “repo squatting”: Fork official repo, commit malicious changes, promote via ads linking to commit hashes under official namespace.
- Multi-stage loader drops HijackLoader; macOS victims get AMOS stealer.
- Uses OpenCL GPU API to crash sandboxes lacking GPU drivers, misleading static analysis on decryption keys.
- Shares IOCs for defense; GitHub commits remain accessible even after fork deletion.
Repo Squatting Delivery
Attackers fork GitHub Desktop (github.com/desktop/desktop), edit README to link malicious installers, and commit.
Victims see it via github.com/desktop/desktop/tree/<commit_hash>, bypassing warnings with anchors like #where-can-i-get-it. Google Ads promote these for “GitHub Desktop” searches.
GitHub Docs note this visibility risk, but commits linger in the network post-deletion. GMO observed installs like GitHubDesktopSetup-x64.exe (SHA256: e252bb114f5c2793fc6900d49d3c302fc9298f36447bbf242a00c10887c36d71), mimicking legit size at 127 MB.
Infection Chain Breakdown
Stage 1: Single-File .NET Loader
The EXE bundles .NET payload in overlay (dump via dnSpy after bundle marker check). It decrypts blobs using all-zero key (revealed after OpenCL fails intentionally).
OpenCL Deception: Loads OpenCL.dll, compiles kernel claiming GPU decryption. But args fail (CL_INVALID_MEM_OBJECT), kernel skips, yielding zero key. Crashes VMs without GPU/OpenCL (e.g., clGetPlatformIDs errors). Real analysis needed physical GPU machine.
Decrypts next payload (SHA256: e5c01a6f3d85c469e16857d92d9f0a1b01d14b0f0dad7df94b1afa6dc1ff4490) with AES-128-CBC (zero IV/key), fetches more from slepseetwork[.]online.
Stage 2: PowerShell Stager
Downloads/executes VBS/PS1 (e.g., SHA256: 8cd7d9ccea98ad6a3dfb4767e574349c9fd5678150c629661574ddd45e40cd37). Copies to %AppData%, adds Defender exclusions (%AppData%, %LocalAppData%, %ProgramData%), creates logon task “WinSvcUpd.”
Extracts archive.zip (e.g., oqiwquwqey[.]xyz/zipep[.]php) to Temp/tmpXXXXX, runs EXEs.
Stage 3-5: DLL Sideloading And HijackLoader
archive.zip holds Control-Binary32.exe (legit) sideloading malicious Qt5Network.dll. It stomps vssapi.dll .text section with decrypted shellcode from Prangshound.hzj (simple add-key decrypt).
HijackLoader (final stage) checks for avgsvc.exe/avastsvc.exe (hashes 0x6CEA4537/0x5C7024B2), delays if found. Decrypts from Kraekgriesfid.xvs, deploys stealers like LummaC2.
IOCs Table
| Category | IOC | Notes |
|---|---|---|
| Malicious Commits (SHA-1) | 3b3e14cec9f2c7f9567bb1a50ece12d4eb337305 | Viewable under official repo |
| Installer URLs | hxxps://git-desktop[.]app/git | Malvertising landing |
| Installers (SHA256) | e252bb114f5c2793fc6900d49d3c302fc9298f36447bbf242a00c10887c36d71 | GitHubDesktopSetup-x64.exe |
| PS Stager (SHA256) | 8cd7d9ccea98ad6a3dfb4767e574349c9fd5678150c629661574ddd45e40cd37 | WinSvcUpd task |
| HijackLoader Files | Qt5Network.dll: 719a726d54161a1a95cf69f3001b74fe15661b83d995b89bcca5ecc8e792e2eb | DLL hijack |
YARA Snippet: Detects .NET bundle + OpenCL strings (full rule in GMO report).
Download from GitHub Releases only. Hunt bundle markers, OpenCL errors, “WinSvcUpd” tasks. Block listed domains/commits. GitHub must limit fork visibility.
This supply chain abuse highlights repo risks for devs. Stay vigilant threat actors adapt fast.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
