Malware campaign uses fake ChatGPT and Claude installers to infect computers
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
The attackers offer on GitHub fake computer programs of ChatGPT and Claude that actually install a harmful program. The package brings a genuine executable signed by OpenAI or Anthropic, which loads a malicious library placed beside it. Check Point Research clarifies that neither company was compromised and that the last program installed in the cases it observed mined cryptocurrency.
Check Point Research (CPR), the research team at Check Point, has described Yoba, a malware campaign built on fake GitHub projects that pass themselves off as desktop apps for ChatGPT and Claude. According to its analysis, published on October 27, the attackers also use legitimate executables signed by OpenAI and Anthropic to load the harmful code. CPR stresses that its research does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised: what is being abused is the trust placed in those brands.
The attackers created repositories and GitHub Pages sites that offered supposed desktop versions of new AI products, with names such as "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus", and the download links led to ZIP files hosted as GitHub releases. CPR saw no sign that the repositories' stars or forks were artificially inflated, but they did show up in prominent spots on Google. From the search-oriented content and the way the installer is delivered, CPR judges that the campaign fits search engine poisoning (SEO poisoning), a technique for placing harmful pages in front of people looking for software.
The package mixes Yoba's components with legitimate software: in the ChatGPT ones there is a genuine Setup.exe signed by OpenAI, and in the Claude one, a genuine signed Claude executable. When opened, that executable loads a malicious winmm.dll file sitting in the same folder, through a technique known as DLL sideloading. The signed executable is legitimate, CPR notes, but what surrounds it is not.
The first component, YobaDropper, checks before going on that it was opened by the expected Setup.exe, applies regional language checks and demands administrator rights; if the first check fails, it waits for a long while. It then installs YobaLoader next to a legitimate Windows executable and creates a scheduled task so that the executable loads it after the system starts. YobaLoader visits a Telegram channel, downloads its profile picture and uses data from it to generate a domain, so the attacker can change the domain by changing the picture; it then queries a DNS TXT record for that domain through Google's DNS-over-HTTPS service and can pull an encrypted payload from outside hosting such as Catbox.
In the campaign analyzed, the final payload was XMRig 6.26.0, a cryptocurrency-mining program that could communicate over Tor and that paused while the victim was using the computer. CPR warns, however, that Yoba is not just a miner: YobaLoader is a generic loader that can deliver other Windows executables or PowerShell scripts, so anyone who finds it should treat the infection as a broader compromise. Among Check Point's recommendations are to download applications through channels controlled by their vendor instead of relying on search results, GitHub pages or third-party links, to restrict unauthorized applications and administrator rights, and to inspect downloads and application behavior.
Why it matters · analysis and opinion
This campaign does not attack OpenAI or Anthropic, but the haste of people searching for the newest model and trusting the first search result. A valid digital signature vouches for one specific executable, but not for everything traveling in the same folder, and the trick comes from there. Whoever manages company computers should set where AI applications are installed from, limit administrator rights and remind staff that a repository named after a model is not an official source. And if someone has already installed it, it is wise to treat it as a compromise of the whole machine, not just a miner to be removed. As long as new models arrive every few weeks, this kind of bait will keep finding an audience.
Official source: Check Point · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This affects any small business, freelancer or professional in Spain and Latin America who installs AI applications on work computers on their own, especially where nobody is in charge of checking what gets downloaded. People who only use ChatGPT or Claude in the browser, through the official website, are not exposed to this particular risk.
In practice, the sensible thing is to set a simple rule: AI applications are downloaded only from the official OpenAI or Anthropic website, never from a search engine link, a GitHub repository or a page promoting a model with an eye-catching name. Check Point Research also recommends that regular users do not have administrator rights, a setting that costs nothing, and using security tools that intercept malicious communications. Our advice is to be wary of any version whose name does not appear in the official announcements of the companies.
The risk is not small: Check Point Research advises treating an infection as a full compromise of the computer, because the Yoba loader can run any program or PowerShell script. If someone on the team thinks they have installed one of these packages, the prudent step is to disconnect that computer from the network, change the passwords used on it from another device and not work on it again until it has been thoroughly checked or reinstalled.
