Fake Desktop Apps for ChatGPT and Claude Distribute Yoba Cryptominer Malware
What Happened — Researchers at Check Point identified a campaign, dubbed Yoba, that publishes counterfeit desktop‑application repositories on GitHub and GitHub Pages. The repositories masquerade as “GPT‑5.6 Sol”, “GPT‑6 Astra” and “Claude Opus”, and host ZIP releases that contain a legitimate OpenAI or Anthropic‑signed executable bundled with a malicious DLL. When a user runs the executable, DLL sideloading loads the malicious code, which installs a cryptocurrency miner. The malware establishes persistence via a scheduled task that appears to be a Windows Media Player job signed by Microsoft. Persistence is followed by a second‑stage loader that contacts a Telegram channel, extracts a profile picture, derives a domain name, and retrieves an encrypted DNS‑over‑HTTPS record to download additional payloads. The campaign relies on SEO poisoning to rank the fake repositories high in Google results, avoiding traditional command‑and‑control infrastructure.
Why It Matters for Trust & Control Assurance — The incident highlights the need for rigorous software‑sourcing controls and continuous monitoring of third‑party code repositories, a single control objective that satisfies many framework requirements (e.g., NIST CSF 2.0).
Who Is Affected — End‑users and organizations that download unofficial desktop clients for AI services; primarily the technology‑SaaS sector and any enterprise that permits unsanctioned software installations.
Recommended Actions
- Enforce a policy that only allows installation of software from verified, approved sources.
- Verify digital signatures and hash values of executables before execution.
- Deploy endpoint detection that can detect DLL sideloading and unauthorized scheduled tasks.
- Monitor external search results for brand‑related SEO poisoning and fake repositories.
- Incorporate third‑party risk monitoring into your continuous assurance program.
Technical Notes
- Attack vector: SEO‑poisoned search results → fake GitHub releases → DLL sideloading.
- Malware behavior: Anti‑sandbox techniques, low detection rates, creates scheduled task under Local System, uses Telegram‑derived domain for C2‑less updates.
- Signed binaries: Legitimate OpenAI/Anthropic executables used as cover.
- Geographic targeting: Skips systems with CIS‑region keyboard layouts; Ukrainian keyboards are explicitly included.