Yoba malware campaign used fake ChatGPT and Claude desktop apps and signed OpenAI and Anthropic binaries to install a cryptominer
Check Point Research reported a campaign it tracks as Yoba that spreads malware through fake GitHub repositories and websites promoting purported AI apps such as "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus". The fake projects ranked among the top Google results, which the researchers attributed to SEO poisoning. The downloads bundle a genuine signed Setup.exe from OpenAI or Anthropic with a malicious winmm.dll. When the signed program runs, it loads the malicious file, a technique called DLL sideloading. In the attacks observed, the final payload was the XMRig cryptominer on victims' Windows systems, but the loader can fetch other executables or PowerShell scripts. Check Point said indicators point to Russian origins but did not name a group. An earlier variant seen in June used a fake Cursor AI coding-agent app.
What the AI did
No AI system acted on its own. Attackers used the names of popular AI apps as bait. They also used genuine, digitally signed installer files from OpenAI and Anthropic to load malicious code that installed a cryptominer on victims' Windows computers.
First reported October 29, 2026 · Added to the register November 7, 2026 · 1 source
- Affected
- Windows users downloading fake AI desktop apps
- When it happened
- Not stated in the sources
- First reported
- October 29, 2026
What this means for you
Could this affect you?
If your staff download AI desktop apps from GitHub or search results. Windows users who downloaded fake AI desktop apps from GitHub projects or search results were exposed. A security expert said developer workstations are especially at risk because they can hold source code, API keys, cloud credentials and access to internal systems.
What to check
- Give staff a fast, approved route to AI tools.
- Block installs from unverified repositories.
- Extend application controls to cover DLL loading, meaning the extra code files a program pulls in when it runs.
- Review permanent local administrator rights on staff computers.
Areas of your AI programme this touches
Every fact and its source (8)
- Malicious releases uploaded30 to 31 August and 4 September (year not stated)“Malicious releases were uploaded on 30 to 31 August and 4 September, according to commit data in the post.”[1]
- Abused signed binariesGenuine signed Setup.exe from OpenAI or Anthropic with malicious winmm.dll“a genuine signed Setup.exe from OpenAI or Anthropic is placed alongside a malicious file named winmm.dll”[1]
- Final payload observedXMRig cryptocurrency miner“The researchers observed XMRig, a cryptocurrency miner, as the campaign’s final payload.”[1]
- Fake AI apps used as luresGPT-5.6 Sol, GPT-6 Astra, Claude Opus“including “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.””[1]
- AttributionIndicators point to Russian origins; no group named“The firm said indicators point to Russian origins but did not name a group.”[1]
- Earlier variantJune variant used fake Cursor AI coding-agent app“Check Point also identified an earlier Yoba variant, observed in June, that used a fake Cursor AI coding-agent application.”[1]
- Distribution techniqueSEO poisoning to rank fake projects in top Google results“still ranked among the top Google results, which the researchers attributed to SEO poisoning”[1]
- Campaign name and researcherYoba, tracked by Check Point Research“The campaign, tracked as Yoba, uses fake GitHub repositories and websites promoting purported AI applications”[1]
Sources
- Fake ChatGPT, Claude apps spread malware via signed AI binariesreseller.co.nz · October 29, 2026
How this record is classified. Severity M (3/5): harm to individuals, or a policy breach with limited reach. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Reported, meaning press reporting only.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
