Attackers Hijacking Official GitHub Desktop Repository to Distribute Malware as Official Installer

Cybercriminals used repo squatting and sponsored ads to distribute a malicious Windows installer (e.g., GitHubDesktopSetup-x64.exe) that impersonates GitHub Desktop and other apps; the loader conceals a .NET payload in the file overlay and leverages OpenCL GPU checks (GPUGate) and code misdirection to evade sandbox/VM analysis, with infections observed primarily in Europe and the EEA and later spreading to Japan.