Attackers Hijack GitHub Desktop Repo to Spread Malware via Official Installer
Recent investigations have revealed that threat actors have exploited a design flaw in GitHub's fork architecture to distribute malware disguised as the legitimate GitHub Desktop installer. This exploitation utilizes a method called "repo squatting,"…
Recent investigations have revealed that threat actors have exploited a design flaw in GitHub's fork architecture to distribute malware disguised as the legitimate GitHub Desktop installer. This exploitation utilizes a method called "repo squatting," where attackers create forked repositories, alter the download links in the README files to point to malicious installers, and commit these changes. Although the commits appear under the official repository's namespace, they are not made with direct write permissions.
The attack, tracked since September 2025, involves using sponsored advertisements to promote the malicious installer, deceiving developers into downloading compromised software. The malicious installer, named GitHubDesktopSetup-x64.exe (SHA256: e252bb114f5c...), is a .NET application functioning as a multi-stage loader. It employs several evasion techniques, including leveraging OpenCL (Open Computing Language) to hinder analysis in virtual environments lacking GPU drivers.
Multi-Stage Loader Delivering HijackLoader
Analysis indicates that similar malware samples have been masquerading under popular application names such as Chrome, Notion, 1Password, and Bitwarden. The loader uses evasion techniques like code misdirection and a clever implementation of OpenCL that contains intentional bugs. These bugs, such as arguments being passed by value rather than reference, complicate static recovery of decryption keys.
The application is identified by an 8-byte bundle header-offset set to 0x7FAB159 . This signature, along with other identifiers, can be used in YARA rules to hunt for related samples.
Although the commits appear under the official repository's namespace, they are not made with direct write permissions.
Upon execution, the malware downloads encrypted archives containing both legitimate signed binaries and malicious payloads. Techniques such as DLL sideloading and module stomping are employed, injecting shellcode into vssapi.dll to execute HijackLoader. Persistence is maintained through a scheduled task named "WinSvcUpd" that executes on user logon.
The malware further employs a PowerShell stager to add Microsoft Defender exclusions for specific directories, allowing subsequent payloads to execute undetected. The campaign was most active between September and October 2025, with infections primarily in Europe and Japan. GitHub was made aware of the vulnerability on September 9, 2025, and as of December 29, 2025, the technique remained reproducible.
Recommendations from security experts include downloading installers exclusively from official Releases pages and exercising caution with sponsored search advertisements. This campaign underscores the importance of supply chain security in mitigating sophisticated malware distribution on trusted platforms.
Based on reporting by GBHackers.