{"data":{"id":"bf232e26-6fd1-4ae9-ad8f-2c6c45de69ca","title":"Fake ChatGPT, Claude apps spread malware via signed AI binaries","summary":"Attackers are distributing malware through fake ChatGPT and Claude desktop applications, bundling genuine signed Setup.exe files from OpenAI and Anthropic with a malicious winmm.dll that loads a dropper via DLL sideloading, according to Check Point Research. The campaign, tracked as Yoba, promotes the fake apps through GitHub repositories and GitHub Pages sites, and the observed final payload was the XMRig cryptominer, though the loader can fetch other executables or PowerShell scripts.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4241634/fake-chatgpt-claude-apps-spread-malware-via-signed-ai-binaries.html","publishedAt":"2026-10-28T12:36:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain","other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Anthropic"],"affectedVendorsRaw":["ChatGPT","Claude","GPT-5.6 Sol","GPT-6 Astra","Claude Opus"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-28T12:36:48.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0010"]}}