Ethics and safety·October 30, 2026, 21:27

Fake ChatGPT and Claude apps hid a crypto miner on PCs

AI-generated from the sources listed, with automated source checks.

According to Check Point Research, a campaign called Yoba has spread fake AI apps that contain genuine, signed installer files from OpenAI and Anthropic. Behind them was a crypto miner that exploits the user's computer.

A new malware campaign lures users into downloading fake AI apps for their computers. Check Point Research published a report on the campaign, which the researchers call Yoba, on October 27, 2026. The information here comes from third-party coverage of the report.

Fake apps in search results

According to CSO Online, the campaign used fake GitHub projects and websites posing as AI apps for the computer. They were named things like "GPT-5.6 Sol," "GPT-6 Astra" and "Claude Opus." According to CSO Online, the malicious releases were posted on August 30-31 and September 4.

The fake projects ranked high in Google's search results. According to Let's Data Science, this was due to search engine manipulation (SEO) and not fake popularity numbers.

Check Point also found variants from June, August and September. An earlier variant from June used a fake version of the coding agent Cursor.

Genuine file with hidden malicious code

The downloads were ZIP packages containing a genuine, digitally signed Setup.exe from OpenAI or Anthropic. Alongside it was a malicious file, winmm.dll, which is loaded by the installer. The technique is called DLL sideloading.

OpenAI's and Anthropic's own apps have not been compromised. According to Let's Data Science, the valid signature merely creates a false sense of security.

The first stage, YobaDropper, waits 12 days unless it is launched by Setup.exe. According to Gridinsoft, it creates a folder and copies a Windows program there. A malicious file is loaded along with it, and a scheduled task starts it at startup with the highest privileges on the computer. The second stage, YobaLoader, ensures that the malware runs again after a restart, according to CSO Online.

According to Gridinsoft, YobaLoader extracts domain names from Telegram profile pictures and downloads encrypted files via DNS over HTTPS. According to Let's Data Science, the campaign uses Telegram, Tor, Catbox and DNS over HTTPS instead of traditional command servers.

The final malicious payload is an XMRig crypto miner, which uses the computer's processing power to mine cryptocurrency. According to Gridinsoft, it pauses while the user is active, making it harder to detect.

What can you do?

According to Let's Data Science, users should download AI apps only from official sources and should not judge authenticity by search ranking or a repository's popularity.

Security expert Yash Kadakia tells CSO Online that a signed file is not the same as a trusted execution chain. CSO Online recommends that companies extend application control to DLL behavior, review administrator privileges on developers' workstations and monitor software from unvetted sources.

The sources do not say how many people were affected or how long the sites were active.