This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's computing power to unpack it, thus defeating a signature-based antivirus that is limited by CPU computing power.

  • Has there been any documented instances of viruses leveraging the GPU occurring in the wild?

  • How have antivirus and antimalware vendors responded to this threat?

  • Does this mean WebGL and WebCL is another vector for exploit?

  • 2
    GPU viruses - that's an odd question. What's a CPU virus ?
    – StefanS
    Dec 15, 2012 at 23:26
  • it's an interesting idea... a GPU virus may leverage bugs in graphics driver... but it will need to support at least the 3 major vendor (nvidia, ATI.. ehm... AMD, and Intel)
    – Max
    Dec 20, 2012 at 8:39
  • 2
    @RoryAlsop The article cited here is not about a GPU virus, but about a CPU virus that only uses the GPU to leverage its computational power. Dec 20, 2012 at 15:59
  • Might I suggest looking for a cached version of the VX Heavens website. This was, by far, one of the best VX resources on the web.
    – V_P
    Dec 20, 2012 at 21:15
  • See our survey paper on attacks and security techniques for GPUs. It discusses GPU-based malware, use of GPU for keylogging, and many other techniques.
    – user984260
    Apr 3, 2018 at 2:57

1 Answer 1


The first GPU-assisted malware is considered to be the Badminer trojan reported by Semantec in 2011. Although its GPU leverage level is pretty low and the risk is low too, this is still the first precedence of using the GPU maliciously in the wild.

Another more intrusive example of the same idea is RiskTool.Win32.BitCoinMiner.

Then antivirus designers started to think really hard. No AV vendor will invent effective GPU-related protection until high-risk GPU-assisted malware starts to appear in large volume and more traditional AV approaches fail. It won't happen very soon. Meanwhile, it's just not feasible to protect against a still imaginary danger.

Everything is a potential attack vector as soon as it becomes more and more profitable. There's no such thing in the world that is not attackable or misusable in some form. Regarding particular WebCL, from Wikipedia: "Currently, no browsers natively support WebCL, seeing as it is new. However, non-native add-ons are used to implement WebCL."

  • Wasn't quite a virus but a bunch of online gaming community users had their GPU's hijacked to mine bitcoins (I was one of them) the company I probably shouldn't name as they have rectified the situation (a rougue employee added the code to their server browser program) - just a little extra info!
    – Dan
    Mar 6, 2014 at 17:16
  • I believe you're talking about E-Sports Entertainment game developer as this article commercehousewirral.co.uk/commerce-house-wirral-latest-news/… describes your case. I don't see any point to refrain from naming/shaming/blaming as our planet simply must know its "heroes". Note, that it's still conventional malware requiring conventional Intel code to become active and proceed, so it's perfectly detectable by conventional AV solutions
    – Van Jone
    Mar 8, 2014 at 7:46
  • Ah, in that case the company was ESEA. (play.esea.net)
    – Dan
    Mar 10, 2014 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .