Fake GitHub projects impersonating ChatGPT and Claude desktop apps use search-engine visibility and DLL sideloading to deliver malware, with cryptocurrency mining observed as the final payload.
Check Point Research (CPR) has uncovered a malware campaign dubbed Yoba that exploits growing demand for AI tools by distributing fake ChatGPT and Claude desktop applications. The campaign combines fraudulent GitHub projects, legitimate digitally signed executables and a multi-stage infection chain to make malicious software appear trustworthy.
The findings highlight a growing risk for organisations adopting generative AI: cybercriminals can exploit the popularity of AI brands without compromising the underlying AI platforms.
According to CPR, attackers created GitHub repositories and GitHub Pages sites advertising supposed desktop applications under names including “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.” Download links directed users to malicious ZIP files hosted through GitHub releases. Although the repositories showed no evidence of artificially inflated stars or forks, they appeared prominently in Google Search, with the campaign exhibiting characteristics consistent with search engine optimisation (SEO) poisoning.
The downloaded packages included legitimate, signed OpenAI or Anthropic executables alongside malicious components. When launched, these applications loaded a malicious winmm.dll placed in the same directory, exploiting a technique known as DLL sideloading. The legitimate signature therefore did not guarantee that the complete software package was safe.
CPR emphasised that its investigation found no evidence that ChatGPT, Claude, OpenAI or Anthropic had been compromised. Instead, attackers exploited the credibility of their brands and the trust associated with signed software.
“Yoba highlights an important distinction: a valid signature can establish the legitimacy of an individual executable, but not of every component packaged alongside it.”
A multi-stage infection chain
YobaDropper performs several checks before deploying the next stage, including verifying that it was launched by the expected installer, checking regional language settings and requiring administrator privileges. It then deploys YobaLoader and establishes persistence through a scheduled task, allowing a legitimate executable to sideload the malicious loader after system startup.
The campaign also uses trusted internet services to retrieve payloads. YobaLoader accesses a Telegram channel and retrieves its profile image, using data from that image to generate a domain. It then queries Google’s DNS-over-HTTPS service for a DNS TXT record associated with the domain before validating and decrypting the response and retrieving an encrypted payload from hosting infrastructure such as Catbox.
This approach reduces reliance on fixed command-and-control servers and can make malicious communications more difficult to distinguish from legitimate internet activity.
In the campaign analysed by CPR, the final payload was XMRig 6.26.0, a cryptocurrency miner. The malware could communicate through Tor and pause mining while the victim actively used the computer. However, researchers warn that YobaLoader can deliver other Windows executables or PowerShell payloads, making the infection chain potentially useful for distributing different forms of malware.
Implications for enterprise security
The campaign reinforces the need to treat software discovery and installation as part of the enterprise AI security challenge. Employees who independently download applications from search results, third-party repositories or unofficial pages may inadvertently introduce malware, even when a package contains a genuine signed executable.
CPR recommends downloading AI software only through vendor-controlled channels, restricting unauthorised applications and unnecessary administrator privileges, and monitoring application behaviour beyond the initial downloaded file.
Endpoint controls that detect malicious files, suspicious execution, persistence mechanisms and command-and-control activity can provide additional protection. Check Point also points to its Threat Emulation, Anti-Bot, behavioural protection and ThreatCloud AI capabilities as relevant layers for identifying threats across the infection chain.
As AI tools become more widely adopted, the lesson from Yoba is clear: organisations must verify not only which applications employees use, but also where those applications originate and what they do after installation. Trust in an AI brand or the digital signature on one executable is not proof that an entire software package is safe.