Fake ChatGPT, Claude apps spread malware via signed AI binaries

Summary

Attackers are distributing malware through fake ChatGPT and Claude desktop applications, bundling genuine signed Setup.exe files from OpenAI and Anthropic with a malicious winmm.dll that loads a dropper via DLL sideloading, according to Check Point Research. The campaign, tracked as Yoba, promotes the fake apps through GitHub repositories and GitHub Pages sites, and the observed final payload was the XMRig cryptominer, though the loader can fetch other executables or PowerShell scripts.

Related items

• InfoSocial media is full of weird video game mashups. Where are they all coming from?Same vendor · The Guardian Technology
• MediumAttacker Relentlessly Scans for Credentials by Impersonating AI BotsSame vendor · Dark Reading
• InfoThe October inflection point for vibe game developmentSame vendor · Simon Willison's Weblog
• InfoStraiker Named to Fortune Cyber 60 for Third Consecutive YearSame vendor · Straiker Blog
• InfoA Shared Language for Agent Defense: Introducing Project QuarrySame vendor · Cisco AI Blog