GPUGate Malware Uses Google Ads and Fake GitHub Commits to Target IT Firms

Cybersecurity researchers describe a new GPUGate malware campaign that uses paid Google search ads and a GitHub commit embedded in manipulated links to lure victims, exclusively targeting IT and software development companies in Western Europe since at least December 2024. The first-stage payload is a bloated 128 MB Microsoft Software Installer that evades many sandboxes, with a GPU-gated decryption routine that only runs on systems with a real GPU.

The attack chain then runs a Visual Basic Script that launches a PowerShell script, which executes with administrator privileges, adds Microsoft Defender exclusions, creates scheduled tasks for persistence, and finally runs executables extracted from a downloaded ZIP archive. The campaign purportedly employs a GitHub lookalike domain and a malicious download hosted on a lookalike site, with Arctic Wolf stating that the technique can bypass user scrutiny and endpoint protections.

It is assessed that the threat actors behind the campaign have native Russian language proficiency, given Russian language comments in the PowerShell script, and the domain is described as a staging ground for Atomic macOS Stealer. According to Arctic Wolf, by exploiting GitHub’s commit structure and Google Ads, threat actors can convincingly mimic legitimate software repositories and redirect users to malicious payloads.