Western European IT and software development firms have been compromised with the GPUGate malware as part of a sophisticated attack campaign involving Google Ads and bogus GitHub commits that has been underway since December, reports The Hacker News.
Malicious actors have exploited Google Ads to promote links redirecting to an illicit URL with a GitHub commit facilitating the distribution of an oversized Microsoft Software Installer that bypasses security sandboxes while payload encryption is being ensured by a GPU-gated decryption routine, according to an Arctic Wolf analysis.
After injecting multiple garbage files for increased stealth, attackers proceed with Visual Basic Script execution leading to the eventual execution of a payload, allowing the theft of data and release of additional payloads, including the Atomic macOS Stealer.
"By exploiting GitHub's commit structure and leveraging Google Ads, threat actors can convincingly mimic legitimate software repositories and redirect users to malicious payloads bypassing both user scrutiny and endpoint defenses," said Arctic Wolf.
Malicious actors have exploited Google Ads to promote links redirecting to an illicit URL with a GitHub commit facilitating the distribution of an oversized Microsoft Software Installer that bypasses security sandboxes while payload encryption is being ensured by a GPU-gated decryption routine, according to an Arctic Wolf analysis.
After injecting multiple garbage files for increased stealth, attackers proceed with Visual Basic Script execution leading to the eventual execution of a payload, allowing the theft of data and release of additional payloads, including the Atomic macOS Stealer.
"By exploiting GitHub's commit structure and leveraging Google Ads, threat actors can convincingly mimic legitimate software repositories and redirect users to malicious payloads bypassing both user scrutiny and endpoint defenses," said Arctic Wolf.
