{"id":10185,"date":"2026-10-28T12:36:48","date_gmt":"2026-10-28T12:36:48","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10185"},"modified":"2026-10-28T12:36:48","modified_gmt":"2026-10-28T12:36:48","slug":"fake-chatgpt-claude-apps-spread-malware-via-signed-ai-binaries","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10185","title":{"rendered":"Fake ChatGPT, Claude apps spread malware via signed AI binaries"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victims\u2019 Windows systems, according to Check Point Research.<\/p>\n

The campaign, tracked as Yoba, uses fake GitHub repositories and websites promoting purported AI applications, including \u201cGPT-5.6 Sol,\u201d \u201cGPT-6 Astra\u201d and \u201cClaude Opus.\u201d<\/p>\n

\u201cThese projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure,\u201d Check Point wrote<\/a> in a blog post.<\/p>\n

The installers bundle genuine signed executables with malicious files that exploit DLL sideloading, a technique in which a legitimate application loads a malicious dynamic-link library, the post added.<\/p>\n

The researchers observed XMRig, a cryptocurrency miner, as the campaign\u2019s final payload. But they warned that the loader can retrieve other Windows executables or PowerShell scripts, making the potential impact broader than cryptomining.<\/p>\n

\u201cFuture waves may deliver different malware families,\u201d the researchers added in the post.<\/p>\n

The projects did not inflate stars or forks but still ranked among the top Google results, which the researchers attributed to SEO poisoning. Malicious releases were uploaded on August 30 and 31 and September 4, according to commit data in the post.<\/p>\n

Signed OpenAI and Anthropic files load the dropper<\/h2>\n

The fake projects use GitHub repositories and GitHub Pages sites to describe the purported applications and direct users to ZIP downloads hosted through GitHub releases.<\/p>\n

Inside the downloaded packages, a genuine signed Setup.exe from OpenAI or Anthropic is placed alongside a malicious file named winmm.dll. When the executable runs, it loads the malicious library, which Check Point calls YobaDropper.<\/p>\n

The dropper stalls for about 12 days unless it is launched by a process named Setup.exe. It skips systems using Russian, Belarusian, Kazakh, and other CIS-region keyboard layouts and demands administrator rights before continuing, the researchers added.<\/p>\n

With elevated rights, it copies a legitimate Windows Media Player binary into the ProgramData folder and places a second malicious DLL beside it. It then creates a scheduled task that lists Microsoft Corporation as its author and runs as Local System three minutes after boot.<\/p>\n

Yash Kadakia, founder and CTO at Security Brigade, said the campaign demonstrates the limitations of relying on software signatures alone.<\/p>\n

\u201cA valid digital signature establishes the authenticity and integrity of a particular executable. It does not establish that everything the executable loads, or the package it was distributed with, is trustworthy,\u201d Kadakia said.<\/p>\n

\u201cA signed executable is not the same thing as a trusted execution chain,\u201d he added.<\/p>\n

Legitimate online services conceal malware delivery<\/h2>\n

After establishing persistence, the second-stage component, YobaLoader, contacts attacker-controlled infrastructure to obtain instructions and download a payload.<\/p>\n

Check Point found that the loader uses a Telegram channel and an image to help generate a domain name, then queries Google\u2019s DNS-over-HTTPS service for encrypted instructions stored in a DNS TXT record. It subsequently retrieves an encrypted payload from the Catbox file-hosting service.<\/p>\n

In the attacks Check Point observed, the payload was an XMRig cryptominer that routes traffic through Tor and pauses while the user is active. The firm said indicators point to Russian origins but did not name a group.<\/p>\n

Kadakia said the use of mainstream online services complicates detection because each connection may appear legitimate when examined separately.<\/p>\n

\u201cRather than maintaining dedicated command-and-control infrastructure that defenders can easily identify and block, Yoba distributes different parts of its communication chain across legitimate services,\u201d he said.<\/p>\n

\u201cFor SOCs that primarily depend on known malicious domains, IP reputation, or traditional DNS monitoring, detection becomes considerably harder.\u201d<\/p>\n

However, the activity is not invisible, Kadakia said. Unexpected DLL loading by signed applications, scheduled tasks that launch copied system binaries, execution from ProgramData, and unusual network connections can provide indicators of compromise. The challenge is correlating those signals across endpoint and network telemetry.<\/p>\n

Check Point also identified an earlier Yoba variant, observed in June, that used a fake Cursor AI coding-agent application.<\/p>\n

CISOs should tighten AI software controls<\/h2>\n

Kadakia said enterprises should make approved AI tools easier to obtain rather than relying on blanket bans that could encourage employees to bypass internal processes.<\/p>\n

\u201cIf employees can discover and install a useful AI tool in minutes but internal approval takes weeks, shadow IT becomes the predictable outcome,\u201d he said.<\/p>\n

He recommended reviewing permanent local administrator privileges on developer workstations, extending application controls beyond executable signatures to DLL loading and execution behavior, and monitoring software originating from unverified repositories or user-writable directories.<\/p>\n

The campaign is particularly relevant to developer environments, Kadakia said, because workstations can hold source code, API keys, cloud credentials, and access to internal infrastructure.<\/p>\n

\u201cThe larger lesson for CISOs is that AI security cannot be limited to preventing employees from sharing sensitive information with AI models,\u201d he said. \u201cThey must also secure the software, identities, privileges, and execution environments through which AI enters the organization.\u201d OpenAI and Anthropic did not immediately respond to requests for comment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victims\u2019 Windows systems, according to Check Point Research. The campaign, tracked as Yoba, uses fake GitHub repositories and websites promoting purported AI applications, including \u201cGPT-5.6 Sol,\u201d \u201cGPT-6 Astra\u201d and \u201cClaude […]<\/p>\n","protected":false},"author":0,"featured_media":10186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10185"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10185"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10185\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10186"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}