Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Summary

Threat actors are distributing malicious loaders and cryptocurrency miners disguised as desktop applications for Anthropic Claude and OpenAI ChatGPT in a campaign called Yoba. Fake GitHub projects claiming to be apps such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus deliver a malware family called YobaLoader, which is placed beside legitimate signed OpenAI and Anthropic executables and loaded through DLL sideloading. Check Point Research reported the activity, and the source says the attackers likely use SEO poisoning to surface the projects in Google results.

Related items

• InfoBuilding a multiplayer game world with autonomous Fable-class modelsSame vendor · Simon Willison's Weblog
• InfoAn updated Model Spec for more capable and beneficial AISame vendor · OpenAI Blog
• MediumLinux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other DistributionsSame vendor · The Hacker News
• InfoGoogle Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon ModelSame vendor · SecurityWeek
• Low3 Ways AI Agents Already Operate in Your BrowserSame vendor · BleepingComputer