Attackers Hijacking Official GitHub Desktop Repository to Distribute Malware as Official Installer

Malware Distribution via GitHub Desktop Repository

A recent cybersecurity threat has emerged where cybercriminals exploit GitHub's infrastructure to distribute malware. This attack involves creating counterfeit GitHub Desktop installers, which appear legitimate and deceive users into downloading malicious software.

Between September and October 2025, the campaign primarily targeted users in Europe and the European Economic Area, with some infections reported in Japan and other regions. The malware is disguised as a standard development tool installer, posing a significant risk to developers who rely on GitHub.

The attack begins when cybercriminals create temporary GitHub accounts and fork the official GitHub Desktop repository. They modify the download links in the README file to redirect users to malicious installers. Sponsored advertisements targeting searches for "GitHub Desktop" are used to further promote these infected files.

GitHub's design, which allows commits from forked repositories to remain visible under the official repository's namespace, is exploited in this attack. This technique, known as repo squatting, complicates the tracking and removal of malicious content.

Analysts at GMO Cybersecurity identified this campaign as an evolving threat. The malicious Windows installer, named GitHubDesktopSetup-x64.exe and sized at 127.68 megabytes, functions as a multi-stage loader. Similar malicious samples have been found under other application names, such as Chrome, Notion, 1Password, and Bitwarden, dating back to May 2025.

Infection Mechanism and Evasion Tactics

The infection mechanism demonstrates advanced technical deception. The malicious installer appears as a standard C++ application but is actually a single-file .NET application bundled into an executable called an AppHost. The malicious .NET payload is concealed within the file's overlay section, making it difficult for simple scanning tools to detect.

The malware also uses a GPU-based API, OpenCL, to prevent analysis in standard sandbox environments. Most security testing sandboxes and virtual machines lack GPU drivers or OpenCL support, requiring researchers to use physical machines with real graphics hardware for analysis.

This approach, termed GPUGate, is designed to impede security researchers. Additionally, the malware uses code misdirection tactics to obscure decryption keys, further complicating analysis.

Based on reporting by Cyber Security News.