Hackers are using GitHub to push fake ChatGPT and Claude apps

A new malware campaign uses fake AI apps with names like "GPT-6 Astra", "GPT-5.6 Sol", and "Claude Opus" to infect victims and mine cryptocurrency. The campaign uses fake GitHub projects to impersonate the applications, and doesn't need phishing emails, as the fake download pages rank prominently in search results - probably through the use of SEO poisoning. In an advisory, researchers at Check Point said the campaign, dubbed Yoba, uses real OpenAI and Anthropic software, with each download including a genuine, signed ChatGPT or Claude installer. The package looks legitimate, but when the real app runs, the malware runs along with it. Importantly, neither ChatGPT and Claude nor OpenAI and Anthropic have themselves been compromised. Instead, the attackers abuse legitimate signed binaries and the credibility associated with the brands.