Tricks from the Past deployed via signed ChatGPT and Claude binaries

Summary

Check Point Research tracked a campaign it calls Yoba, in which attackers post fake GitHub projects posing as AI desktop apps such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The malware sits beside legitimate, signed OpenAI and Anthropic executables and is loaded through DLL sideloading. The actor avoids dedicated command-and-control infrastructure and relies on Telegram, Tor, Catbox, and DNS over HTTPS.

Related items

• InfoAnthropic’s elaborate plan to keep Wall Street at baySame vendor · The Verge (AI)
• LowResearchers Break Into Anthropic’s Systems in Just 12 Hours—Through Third-Party SoftwareSame vendor · ReversingLabs Blog
• InfoAnthropic accelerates – for the rest of us, the speed of growth spells precaritySame vendor · The Guardian Technology
• InfoApple is adding an AI chatbot to Pages, Keynote, and NumbersSame vendor · The Verge (AI)
• InfoUK Politician Jess Asato Got Deepfaked. Now She’s Taking xAI to CourtSame vendor · Wired (Security)