Fake ChatGPT and Claude apps: the Yoba campaign hides a cryptominer behind signed executables

The fake ChatGPT and Claude apps distributed by the Yoba malware campaign contain something that is baffling at first glance: a genuine executable, digitally signed by OpenAI or by Anthropic. And yet the package as a whole is malware.

The signature does not lie about that file; it simply says nothing about the rest of the folder. That is why this campaign shifts attention from technical indicators to a prior question: where do employees get their AI tools from, and what are they allowed to run?

Yoba poses as ChatGPT and Claude desktop applications

Check Point Research published its analysis of Yoba on 27 October, according to Infosecurity Magazine. The campaign, which the firm has been tracking for about two months, exploits the popularity of tools such as ChatGPT and Claude [1][2]. According to that report, the attackers create fake GitHub projects that present themselves as desktop applications with names such as "GPT-5.6 Sol", "GPT-6 Astra" or "Claude Opus" [1].

The setup is carefully built. Check Point describes repositories accompanied by GitHub Pages sites that explain the supposed capabilities of the program, and whose download links point straight to ZIP files published as releases of the repository itself [1]. Using GitHub's real infrastructure helps everything look legitimate.

Nor is it a one-day operation. The Hacker News reports that the first repository was created around July 2026, although the malicious releases were not uploaded until late August [6]. Infosecurity Magazine adds that an earlier variant, which posed as the Cursor coding agent, appeared in early June [2], and Help Net Security specifies that this version used the same Telegram channel as the current one [3]. The bait changes according to the product people are searching for at any given moment.

In the cases observed, the end of the chain is a cryptominer: according to Check Point, as reported by Infosecurity Magazine, the final payload was an XMRig cryptominer [2].

The executable is legitimate and signed; the malicious part is what accompanies it

The technical core of Yoba can be understood without jargon. In this campaign, the signed executable loads a DLL library from its own folder. If someone leaves a malicious DLL there with the expected name, the legitimate program loads it without knowing.

How DLL sideloading works in this campaign

According to Check Point, the malware is placed next to legitimate, signed OpenAI and Anthropic executables so that it is loaded indirectly. The technique is known as DLL sideloading and is often used to evade security protections [1]. Specifically, the package includes a genuine Setup.exe and a malicious winmm.dll file; in the version that imitates Claude, the signed executable is Claude's [1]. CSO Online specifies that the targets are Windows systems [4]. In practice, this is DLL sideloading with signed executables, and it is what makes these fake AI desktop apps malware rather than just a suspicious download.

When the installer is opened, the person starts real software that, in turn, runs the attacker's code. From there, according to CSO Online, the malicious component requests administrator privileges before continuing [4], and Help Net Security describes a scheduled task that masquerades as a Windows Media Player task attributed to Microsoft [3].

Why a valid signature does not prove the package is safe

Notebookcheck sums it up clearly: the signature covers the installer, not the file next to it [5]. Along the same lines, Yash Kadakia of Security Brigade explains in CSO Online that a valid digital signature attests to the authenticity and integrity of a specific executable, but not that everything it loads, or the package it is distributed in, can be trusted [4].

Check Point adds a revealing detail: the ZIP files were not password-protected, something that is common to hinder automated analysis, because the binaries already had very low detection rates thanks to their anti-sandbox and anti-analysis techniques [1]. When the signed file is genuine and the malicious part goes unnoticed, the detection that helps is the kind that observes what the process does, not just who signed it; that is the territory of AI-based threat detection in a Security Operations Center (SOC).

The real vector is where employees look for their AI tools

This is worth stressing because it changes the focus of the defence. Eli Smadja of Check Point states, as reported by Help Net Security, that the research does not indicate that ChatGPT, Claude, OpenAI or Anthropic have been compromised, and that the attackers abuse legitimate signed binaries and the credibility of those brands [3].

A search engine can lead to the fake download pages. Check Point observes that the repositories showed no signs of fake engagement, such as inflated stars or forks, promoting them within GitHub itself, and yet they appeared among the top Google results [1]. The firm attributes this, most likely, to SEO poisoning on GitHub: optimising titles, descriptions and domains so that a malicious project climbs positions in external search engines [1]. Infosecurity Magazine points to the same explanation [2].

That moves the problem into the realm of governance. Kadakia warns in CSO Online that if an employee can find and install a useful tool in minutes but internal approval takes weeks, unauthorised IT use is the predictable result, and he recommends making approved tools easy to access instead of resorting to blanket bans [4]. Deciding which tools are approved, who evaluates them and through which channel they are obtained is part of AI security governance, not a matter for the systems department alone.

Legitimate services and changing domains make blocking harder

Faced with a campaign like this, the usual reflex is to block specific domains and indicators. They are useful, but the report itself explains why they have a short shelf life: Check Point highlights the actor's operational security, which avoids dedicated command-and-control infrastructure and relies on Telegram, Tor, Catbox and DNS over HTTPS [1].

Help Net Security details the mechanism: the loader downloads the profile picture of a Telegram channel and uses it to generate a domain name, so the operator can change domain simply by changing the image; for that reason, blocking a specific server or domain does little to slow the overall mechanism [3]. According to Check Point, as reported by The Hacker News, relying on DNS over HTTPS and common file-hosting services is intended to evade passive DNS monitoring and some gateway protections, and to blend the traffic in with users' normal activity [6].

That does not make Yoba invisible. Kadakia lists usable signals in CSO Online: signed applications that load unexpected DLLs, scheduled tasks that launch copies of system binaries, execution from ProgramData and unusual network connections; the difficulty lies in correlating them across endpoint and network telemetry [4]. There is also a practical nuance: according to CSO Online, the miner paused its activity while the user was active [4], so waiting for someone to notice a slow machine is not a strategy. When an organisation cannot sustain that correlation with its own resources, it can assess whether a managed monitoring and response service (SOCaaS/MDR) meets that need.

Help Net Security also reports Check Point's warning that, if Yoba is found on a system, the infection should be treated as a broader compromise and not limited to detecting or removing XMRig [3], because the loader can deliver other executables or PowerShell scripts [2].

Four proposed controls to make the chain harder

Check Point advises caution when installing AI applications from unverified repositories and restricting the execution of software of unknown origin [2]. Notebookcheck makes this concrete for the user: genuine applications only come from their developers, and a GitHub repository with a model's name in the title is not an official source, however high it appears in the results [5].

Table of controls and which Yoba step they interrupt

The following table is an editorial proposal based on that logic, not a finding from the sources:

The second control has a direct basis in the sources: Kadakia recommends reviewing permanent local administrator privileges and extending application control beyond the signature, to DLL loading and execution behaviour [4].

If someone has already downloaded one of these files, Notebookcheck advises deleting it without opening it; and if they ran the installer, disconnecting the machine from the network, looking for a WMProcess folder inside ProgramData and running a full scan [5].

Training so that download habits change

Technical controls reduce the damage, but the initial decision is made by a person in front of a search engine. Short, concrete training can teach three habits: reaching the download from the manufacturer's website by typing the address, not trusting a result's position in search listings, and being wary of product names that do not appear on the official site. The very name of the fake apps, such as "GPT-6 Astra", is already a signal to check before installing. Building those habits is the aim of a security training and awareness programme.

Trust in an AI tool is decided before downloading it, not after signing it

Check Point's research does not indicate that ChatGPT, Claude, OpenAI or Anthropic have been compromised. The campaign combines names of AI tools, well-ranked pages on Google and legitimate signed executables. What Check Point observed over these two months is a cryptominer, but, as Notebookcheck points out, the loader is generic and could deliver password stealers or remote access trojans [5].

The idea worth taking away is simple: a valid signature does not make a package downloaded from the wrong place safe. Adopting AI securely starts with knowing where each tool comes from and who can install it, and continues with watching what it does once it is on the machine. For organisations taking that step, organising the catalogue and the channels through AI security governance is a good starting point.