Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victims’ Windows systems, according to Check Point Research.
The campaign, tracked as Yoba, uses fake GitHub repositories and websites promoting purported AI applications, including “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.”
“These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure,” Check Point wrote in a blog post.
The installers bundle genuine signed executables with malicious files that exploit DLL sideloading, a technique in which a legitimate application loads a malicious dynamic-link library, the post added.
The researchers observed XMRig, a cryptocurrency miner, as the campaign’s final payload. But they warned that the loader can retrieve other Windows executables or PowerShell scripts, making the potential impact broader than cryptomining.
“Future waves may deliver different malware families,” the researchers added in the post.
The projects did not inflate stars or forks but still ranked among the top Google results, which the researchers attributed to SEO poisoning. Malicious releases were uploaded on August 30 and 31 and September 4, according to commit data in the post.
Signed OpenAI and Anthropic files load the dropper
The fake projects use GitHub repositories and GitHub Pages sites to describe the purported applications and direct users to ZIP downloads hosted through GitHub releases.
Inside the downloaded packages, a genuine signed Setup.exe from OpenAI or Anthropic is placed alongside a malicious file named winmm.dll. When the executable runs, it loads the malicious library, which Check Point calls YobaDropper.
The dropper stalls for about 12 days unless it is launched by a process named Setup.exe. It skips systems using Russian, Belarusian, Kazakh, and other CIS-region keyboard layouts and demands administrator rights before continuing, the researchers added.
With elevated rights, it copies a legitimate Windows Media Player binary into the ProgramData folder and places a second malicious DLL beside it. It then creates a scheduled task that lists Microsoft Corporation as its author and runs as Local System three minutes after boot.
Yash Kadakia, founder and CTO at Security Brigade, said the campaign demonstrates the limitations of relying on software signatures alone.
“A valid digital signature establishes the authenticity and integrity of a particular executable. It does not establish that everything the executable loads, or the package it was distributed with, is trustworthy,” Kadakia said.
“A signed executable is not the same thing as a trusted execution chain,” he added.
Legitimate online services conceal malware delivery
After establishing persistence, the second-stage component, YobaLoader, contacts attacker-controlled infrastructure to obtain instructions and download a payload.
Check Point found that the loader uses a Telegram channel and an image to help generate a domain name, then queries Google’s DNS-over-HTTPS service for encrypted instructions stored in a DNS TXT record. It subsequently retrieves an encrypted payload from the Catbox file-hosting service.
In the attacks Check Point observed, the payload was an XMRig cryptominer that routes traffic through Tor and pauses while the user is active. The firm said indicators point to Russian origins but did not name a group.
Kadakia said the use of mainstream online services complicates detection because each connection may appear legitimate when examined separately.
“Rather than maintaining dedicated command-and-control infrastructure that defenders can easily identify and block, Yoba distributes different parts of its communication chain across legitimate services,” he said.
“For SOCs that primarily depend on known malicious domains, IP reputation, or traditional DNS monitoring, detection becomes considerably harder.”
However, the activity is not invisible, Kadakia said. Unexpected DLL loading by signed applications, scheduled tasks that launch copied system binaries, execution from ProgramData, and unusual network connections can provide indicators of compromise. The challenge is correlating those signals across endpoint and network telemetry.
Check Point also identified an earlier Yoba variant, observed in June, that used a fake Cursor AI coding-agent application.
CISOs should tighten AI software controls
Kadakia said enterprises should make approved AI tools easier to obtain rather than relying on blanket bans that could encourage employees to bypass internal processes.
“If employees can discover and install a useful AI tool in minutes but internal approval takes weeks, shadow IT becomes the predictable outcome,” he said.
He recommended reviewing permanent local administrator privileges on developer workstations, extending application controls beyond executable signatures to DLL loading and execution behavior, and monitoring software originating from unverified repositories or user-writable directories.
The campaign is particularly relevant to developer environments, Kadakia said, because workstations can hold source code, API keys, cloud credentials, and access to internal infrastructure.
“The larger lesson for CISOs is that AI security cannot be limited to preventing employees from sharing sensitive information with AI models,” he said. “They must also secure the software, identities, privileges, and execution environments through which AI enters the organization.” OpenAI and Anthropic did not immediately respond to requests for comment.
