GPUGate Malware Leverages Legitimate Platforms to Deliver Advanced Payloads

A malware campaign dubbed GPUGate is exploiting trusted platforms and hardware-dependent evasion to deliver its payload across Western Europe, with researchers noting the attackers use Google Ads and GitHub infrastructure to spread it. Arctic Wolf’s Cybersecurity Operations Center first identified the campaign on 19 August 2025, describing it as a sophisticated operation that uses GPU hardware in its OpenCL-based decryption routine to bypass traditional analysis environments.

Victims click malicious Google Ads that mimic GitHub branding and are redirected to a commit-based page on legitimate GitHub repositories, where README files are altered to point to attacker-controlled download links via a domain such as gitpage[.]app.

The initial installer is a 128 MB MSI file masquerading as GitHubDesktopSetup-x64.exe, with a first stage decrypted by XOR key 0x5A before spawning a second-stage payload; the decryption checks require GPU device name lengths longer than 10 characters, effectively excluding virtual machines. The campaign also targets macOS using AMOS Stealer and is believed to involve Russian-speaking threat actors, with persistence mechanisms and multi-domain command-and-control.

The operation spans December 2024 to August 2025, and operates as a malware‑as‑a‑service model, expanding the potential victim pool beyond Windows to include macOS users.