Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Summary: A campaign Check Point Research calls Yoba uses fake GitHub projects posing as AI desktop apps for OpenAI and Anthropic - named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus - to deliver a malware family called YobaLoader, placed next to legitimate signed OpenAI and Anthropic executables so it loads via DLL sideloading. The repositories, surfaced through suspected SEO poisoning, carry ZIP archives with a dropper (YobaDropper) that requires launch under "Setup.exe" and a loader (YobaLoader) that requires "wmpdmc.exe," ending in an XMRig cryptocurrency miner injected into svchost.exe.
What you should know: The dropper runs 200,000 iterations of Sleep(5500) - 12.73 days - and skips machines with keyboard layouts for Russia, Belarus, and eight other listed countries, so a sandbox that gives up early or a host in those regions never sees the miner at all.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026