Fake AI Desktop Apps Signed with Legitimate Certificates Deploy Cryptocurrency Miners
What Happened — A threat‑actor campaign dubbed Yoba is publishing counterfeit GitHub projects that masquerade as desktop AI tools for Anthropic Claude and OpenAI ChatGPT (e.g., “GPT‑5.6 Sol”, “Claude Opus”). The installers are signed with valid code‑signing certificates, allowing them to bypass many security controls. Once executed, the loaders drop a malware family that installs persistent cryptocurrency miners on the victim’s machine. The campaign has been observed delivering the payload to Windows workstations worldwide, with victims reporting degraded performance and elevated CPU usage. The abuse was first reported by security researchers in October 2026 after multiple detections in endpoint protection platforms.
Why It Matters for Trust & Control Assurance — The use of legitimate signatures to distribute malicious binaries underscores the need for continuous verification of software provenance and mapping of supply‑chain controls to a unified assurance framework.
Who Is Affected — Technology‑SaaS vendors, enterprise IT departments that allow end‑user installation of desktop applications, and developers publishing open‑source tools.
Recommended Actions
- Verify code‑signing certificates against a trusted publisher list and reject unknown or newly issued certificates.
- Deploy application allow‑listing and hash‑based verification for all executables, especially those downloaded from public repositories.
- Integrate continuous monitoring of binary signatures and runtime behavior into your security operations.
- Conduct periodic audits of software‑supply‑chain controls and map findings to your audit‑readiness framework.
Source: The Hacker News
Technical Notes
- Attack vector: Signed malicious executables delivered via fake GitHub releases.
- Malware family: Custom loader that installs persistent cryptocurrency miners (CPU‑intensive, stealthy).
- Indicators: Executable hashes, certificate thumbprints, GitHub repository names.
Source: The Hacker News