GitHub Desktop installer spoofed for malware delivery

GBHackers News reports that malware masquerading as the GitHub Desktop installer has been deployed by abusing GitHub fork architecture.

Multiple disposable GitHub accounts have been created by threat actors, who forked the legitimate GitHub Desktop repository to include a malicious download link directing to their installer in a bid to ensure persistence even after fork deletion, according to an analysis from GMO Cybersecurity. Attackers then use search result ads to promote the illicit GitHubDesktopSetup-x64.exe installer, which resembled older samples spoofing the Google Chrome, 1Password, Bitwarden, and Notion apps.

Execution of the counterfeit GitHub Desktop installer, which not only leverages OpenCL to circumvent analysis but also intentionally misdirects code to hinder decryption key recovery, results in the deployment of the HijackLoader malware, as well as the creation of a scheduled task for persistence. Such a threat highlights the importance of downloading installers only from official release pages, researchers said.