Yoba malware spreads via fake ChatGPT and Claude desktop apps on GitHub
ChuckDBrooks · x · 2026-10-30
Check Point has tracked a malware campaign dubbed Yoba for two months: fake GitHub repos and GitHub.io pages posing as desktop versions of ChatGPT and Claude ("GPT-5.6 Sol," "GPT-6 Astra," "Claude Opus") distribute malicious ZIP releases.
Key details:
- The repos show no fake engagement (no inflated stars/forks) yet rank top on Google — likely SEO poisoning, with attackers optimizing titles, descriptions, and domains for external search engines.
- Each archive contains a legitimately signed executable from OpenAI or Anthropic paired with a malicious DLL, using DLL sideloading to bypass protections.
- The final payload is a cryptocurrency miner.
- Researchers stress ChatGPT, Claude, OpenAI, and Anthropic were not compromised — attackers only abused legitimate signed binaries and brand credibility.
More from Safety
- Heads Of Security: paper pinpoints and rewires attention heads behind prompt injections — jonasgeiping · 2026-10-31
- House Democrats resolution: no bailouts for failing AI companies — your data goes to bankruptcy court — alex_verem · 2026-10-31
- Amazon Echo kills local voice storage: everything goes to the cloud from March 28 — alex_verem · 2026-10-31
- DOJ's first crackdown on AI-assisted "ghost students" seizes $750K+ in crypto — Ars Technica AI · 2026-10-31
- Researcher Finds 600+ Bugs in LLM Kernel Code; Claude Blocks Safety Analysis — pmddomingos · 2026-10-31
- Anthropic sued for allegedly training AI models on 274 Elvis Presley songs — TinfoilTricorn · 2026-10-31