Fake ChatGPT and Claude Apps Use Signed Executables to Install Yoba Malware

Fake ChatGPT and Claude apps spread Yoba malware through GitHub, using signed executables to load a cryptominer on Windows PCs and support other payloads. Attackers are distributing fake ChatGPT and Claude desktop applications through GitHub, packaging malware alongside genuine executables signed by OpenAI and Anthropic. The campaign came to light through research by Check Point, whose analysts observed cryptocurrency-mining software being installed on Windows computers through a loader capable of delivering other malware. In its research, Check Point calls the campaign Yoba and describes fake GitHub projects offering supposed “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus” desktop apps. The attackers bundled malware with genuine signed executables, without compromising OpenAI or Anthropic.