Fake ChatGPT and Claude apps on GitHub push XMRig malware, Check Point warns
TechNadu · x · 2026-10-28
Check Point Research exposed the "Yoba 2026" campaign: SEO poisoning and malicious GitHub repositories distribute fake ChatGPT and Claude desktop apps.
Attack chain
- DLL sideloading: a malicious winmm.dll placed alongside legitimately signed OpenAI/Anthropic Setup.exe binaries establishes persistence
- Payloads are fetched via abused Telegram profiles, Google DNS-over-HTTPS, and Catbox
- XMRig 6.26.0 cryptominer is injected into svchost.exe, with traffic routed through a local Tor proxy
Stick to official download channels — third-party "desktop builds" of AI apps are an active attack vector.
Related event: Fake ChatGPT and Claude Apps on GitHub Spread XMRig Miner(2 posts)→
More from Safety
- Only Then Labs prototypes re-checking agent approvals when underlying evidence changes — tallmetommy · 2026-10-28
- Sam Altman's World pitches Orb eye-scanning to banks, drawing sci-fi horror comparisons — rschu · 2026-10-28
- Claude Catches North Korean Supply Chain Attack Disguised as an Auth Error — banteg · 2026-10-28
- AMA: Harvard's Stephen Casper on AI safeguards, incidents and governance, Oct 28 — NeuralNomad87 · 2026-10-28
- Detection Isn't Blocking: How to Actually Verify Your AI Agent's Security Guard — shoumikgoswami · 2026-10-28
- Security Asked: Which MCP Servers Are Safe for Enterprise Use, and How Do We Govern Them? — MorePerspectived · 2026-10-28