Yoba attackers use fake ChatGPT and Claude apps to install crypto miners

The campaign uses fake GitHub projects posing as AI desktop applications to distribute malicious loaders through signed executables. Check Point Research tracked the operation for two months, according to Security Affairs, which reports that the malware chain uses legitimate OpenAI and Anthropic binaries to help deploy a cryptocurrency miner.

• The Hacker News says fake projects include apps named GPT-5.6 Sol and GPT-6 Astra.

Covered by 3 publishers within 30 hours of the first report.

• The Hacker News: Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Reporting3

THN The Hacker News Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners · info@thehackernews.com (The Hacker News) 11:20 AM

AH Android Headlines Fake ChatGPT Desktop Apps Are Secretly Infecting PCs Through Google · Jean Leon 1:10 PM

SAF Security Affairs Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries · Pierluigi Paganini 5:22 PM

Related

CSN Claude AI Detects Hidden Crypto Miner While Building Temperature Monitor App on Mac October 19

AH Sweden Just Banned ChatGPT and Claude on Government Computers Over Data Leak Fears October 26

FO Anthropic introduces Claude Duet for background work across connected apps October 21

AT OpenAI models hacked a crypto wallet and breached more websites October 16

Topics OpenAIAnthropicCrypto