Emerging GPU and Endpoint Attacks Defeat Trusted Security Controls

Researchers have identified two (2) sophisticated cyber threats that show how attackers can bypass protections traditionally considered reliable. The University of Toronto’s GPUThor attack can overcome NVIDIA ECC safeguards on several Ampere-based professional GPUs by producing unusually high numbers of memory bit flips. An attacker able to run an unprivileged CUDA workload could crash GPU operations, trigger repeated resets, corrupt page tables, access protected system memory, and potentially gain root privileges. This makes shared GPU infrastructure, AI platforms, and multi-tenant cloud environments especially vulnerable, even when ECC is enabled. Separately, a campaign targeting Cambodia uses convincing phishing documents to install Spark RAT through DLL sideloading, encrypted payloads hidden in PNG files, and analysis-evasion techniques. The attackers also exploit a vulnerable OPSWAT driver to elevate privileges and disable Microsoft Defender and other endpoint security products before establishing persistence and injecting malicious code into running processes. Although the activity resembles tactics associated with the Silver Fox group, researchers have not confirmed attribution, and there is currently no reported evidence that GPUThor is being actively exploited. Together, these threats reinforce the need for layered defenses, including IOMMU and DMA isolation, SYS-ECC, GPU telemetry monitoring, vulnerable-driver controls, phishing protection, and strict limits on untrusted workloads. CTIX analysts will continue to report on the latest malware strains and attack methodologies.