Yes, a Linux rootkit can use GPU computing as part of a proof of concept, but using a GPU does not guarantee evasion. In a May 8, 2015 report, SecurityWeek described Jellyfish, a Linux rootkit proof of concept combining LD_PRELOAD with OpenCL, and separately covered Demon, a GPU-keylogger proof of concept. Earlier academic work had demonstrated a GPU-based keylogger prototype, but none of these sources establishes that Jellyfish or Demon became prevalent in real-world attacks or that they work with current systems.
What Jellyfish was—and what the report actually established
SecurityWeek reported that Team Jellyfish published Jellyfish’s source code on GitHub and described the project as a Linux rootkit proof of concept. The report said it combined the LD_PRELOAD technique associated with the Jynx Linux rootkit and OpenCL, and that OpenCL drivers were required. It described the PoC as designed for AMD and NVIDIA graphics cards, with Intel products supported through AMD APP SDK. Those are claims about the project as reported in 2015, not a statement of compatibility with current graphics hardware, drivers, or compute stacks. SecurityWeek’s May 8, 2015 report
As an Amazon Associate I earn from qualifying purchases.
The report attributed claims about stealth, GPU memory, and direct memory access to Team Jellyfish. These should be read as developer assertions, not independently established findings about the published code. SecurityWeek also reported that the developers presented the project as educational and called the code beta with bugs. That qualification matters: a proof of concept can illustrate an idea without demonstrating reliable, universal, or lasting evasion.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Jellyfish and Demon were different proof-of-concept projects
SecurityWeek discussed Demon alongside Jellyfish, but they had different stated purposes and mechanisms. Demon was presented as a GPU keylogger; Jellyfish as a rootkit focused on hiding components. The 2015 report described Demon as using code injection and Jellyfish as using LD_PRELOAD. The comparison below reflects that report’s descriptions, not a current technical assessment of either project.
#1 Best Overall
- Axial-tech fans now feature a smaller fan hub that facilitates longer blades and a barrier ring that increases downward air pressure
- 2.5-slot design allows for greater build compatibility while maintaining cooling performance
- 0dB technology lets you enjoy light gaming in relative silence
- Dual BIOS switch lets you toggle between Quiet and Performance BIOS profiles
- Dual ball fan bearings last up to twice as long as sleeve bearing designs
| Project or work | Reported purpose | Reported approach | Evidence and limits |
|---|---|---|---|
| Jellyfish | Linux rootkit proof of concept, described as hiding components | LD_PRELOAD with OpenCL |
Described by SecurityWeek in 2015; current compatibility and real-world prevalence are not established. |
| Demon | GPU keylogger proof of concept | Code injection, according to SecurityWeek | Covered in the same 2015 report; not equivalent to the academic prototype it referenced. |
| EuroSec ’13 prototype | Academic GPU-based keylogger | GPU monitored a keyboard buffer in host memory via DMA after a one-time kernel-context bootstrap | Authors’ 2013 prototype and experiments; not proof that Jellyfish used the same design or that Demon reproduced every detail. |
SecurityWeek quoted Demon’s developers as saying they were not affiliated with the paper’s authors and had “PoC’d what was described in it, plus a little more.” The report does not identify a named speaker, so the statement belongs to Demon’s developers collectively. It does not establish that Demon reproduced the paper’s implementation or results.
What the earlier GPU-keylogger research demonstrated
The 2013 EuroSec paper by Evangelos Ladakis, Lazaros Koromilas, Giorgos Vasiliadis, Michalis Polychronakis, and Sotiris Ioannidis described its own Linux keylogger prototype. Its abstract explains the central idea: “monitor the system’s keyboard buffer directly from the GPU via DMA, without any hooks or modifications in the kernel’s code and data structures besides the page table.” The authors describe a one-time kernel-context bootstrap to locate the keyboard buffer; after that, a GPU component monitored host memory through direct memory access and stored and analyzed captured data in GPU memory. Read the EuroSec ’13 paper
Rank #2
- Powered by the NVIDIA Blackwell architecture and DLSS 4
- Powered by GeForce RTX 5070 Ti
- Integrated with 16GB GDDR7 256bit memory interface
- PCIe 5.0
- WINDFORCE cooling system
This is evidence that researchers built and evaluated a particular prototype, not evidence that GPU-based keylogging is undetectable or that Jellyfish used the same design. Keeping those distinctions clear avoids turning a technical demonstration into a broader claim about attacks in the wild.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The paper’s numbers belong to its historical test setup
The authors evaluated a 32-bit x86 implementation on Ubuntu Linux 12.10 with Linux kernel 3.5.0, an Intel E6750 dual-core CPU, 4 GB of host memory, and NVIDIA GT630 and GTX480 graphics cards. At a 90 ms invocation interval, they reported approximately 0.1% CPU utilization and 5 × 10⁻⁵% GPU utilization. They also measured approximately 0.005 ms to read the eight-byte keyboard buffer over PCIe. These are results from that specific prototype and setup in 2013; they should not be treated as benchmarks for present-day machines.
Rank #3
- Powered by the NVIDIA Blackwell architecture and DLSS 4
- Powered by GeForce RTX 5060
- Integrated with 8GB GDDR7 128bit memory interface
- PCIe 5.0
- WINDFORCE cooling system
Why GPU execution raised a defensive question
The academic authors argued that malware-analysis and detection systems of their time were tailored to CPU architectures, and that defenders needed ways to analyze GPU machine code. The underlying visibility challenge is that code can run on a different processor and work with data in device memory, complicating analysis built around CPU execution. The paper discussed research-era tools such as CUDA debugging and memory-checking facilities as examples of analysis support.
That historical argument is not an evaluation of modern security products. The cited sources do not establish that current defenses lack GPU analysis, nor do they validate any particular product’s ability to detect these proof-of-concept techniques. Ordinary GPU use is not, by itself, evidence of infection.
Quick Recap
Best Value
- Axial-tech fans now feature a smaller fan hub that facilitates longer blades and a barrier ring that increases downward air pressure
- Phase-change GPU thermal pad helps ensure optimal heat transfer, lowering GPU temperatures for enhanced performance and reliability
- 2.5-slot design allows for greater build compatibility while maintaining cooling performance
- Dual-ball fan bearings last up to twice as long as standard conventional sleeve bearings designs
- 0dB technology lets you enjoy light gaming in relative silence
Rank #4
- Powered by Radeon RX 9070 XT
- WINDFORCE Cooling System
- Hawk Fan
- Server-grade Thermal Conductive Gel
- RGB Lighting
What remains unknown
- The reviewed sources do not establish whether Jellyfish or Demon were used in real-world attacks or how prevalent they became.
- The 2015 report does not establish whether either proof of concept works with modern Linux distributions, graphics hardware, drivers, or compute stacks.
- The 2013 paper does not measure the effectiveness of current commercial defenses against GPU-based malicious code.
- The developers’ reported stealth and memory-persistence claims are not independently confirmed by these sources; they do not show that a GPU necessarily retains malware after power-off.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
