Fake ChatGPT and Claude apps use signed files to deploy crypto miners

The Yoba malware campaign

A new campaign dubbed Yoba is targeting users interested in artificial intelligence by distributing malicious software. Threat actors are creating fake GitHub projects that claim to offer desktop applications for popular tools like Anthropic Claude and OpenAI ChatGPT. These fake projects use names like GPT-6 Astra and Claude Opus to lure in curious users.

As The Hacker News reported, the attackers set up GitHub.io pages to describe the features of these non-existent software tools. They use SEO poisoning tactics to ensure that these fake project links appear at the top of Google search results. This helps them reach a wider audience without needing to manipulate GitHub's internal popularity metrics.

The malicious files are packaged in ZIP archives within these repositories. These archives contain a legitimate signed executable from OpenAI or Anthropic alongside a malicious file called winmm.dll. By placing the malware next to a trusted file, the attackers can use a technique called DLL sideloading to bypass security protections.

Technical tricks and evasion

The malware uses several clever methods to avoid detection by security researchers and automated systems. One component, YobaDropper, checks the hash of the host executable to ensure it is only running under a specific legitimate file. If the file is run inside a sandbox environment for testing, the malware will fail to execute.

The campaign also includes specific geographical exclusions to avoid detection by authorities in certain regions. The malware skips machines with keyboard layouts from countries like Russia, Belarus, and several Central Asian nations. It also excludes the Tatar language ID from the infection process, though it notably does not exclude Ukraine in the current versions.

To further delay analysis, the malware includes a sleep command that lasts for 12.73 days. This long delay is designed to outlast the time a security researcher might spend observing a suspicious file in a test environment. The attackers also use inconsistent time zones across different accounts to hide their true location.

Command and control tactics

Once the malware is active, it establishes a way to receive instructions from the attackers. It uses a domain generation algorithm to create unique web addresses based on dictionary words and random numbers. These domains are then used to query Google's DNS-over-HTTPS API to fetch encoded commands.

Using DNS-over-HTTPS allows the attackers to hide their communication from passive DNS monitoring. This makes it much harder for network security tools to distinguish the malicious traffic from regular user activity. The commands received from these records provide links to fetch the final stage of the malware.

The final payload is downloaded from a common file-hosting platform and injected into a standard system process. This process is svchost.exe, which is a common Windows component. Once injected, the malware installs an XMRig cryptocurrency miner, which uses the victim's computer power to mine digital currency.

Targeting AI enthusiasts

The Yoba campaign specifically exploits the massive public interest in new AI models. By naming their fake apps after upcoming versions like GPT-5.6, the attackers capitalize on the desire for the latest technology. They rely on the fact that many users may not know how to verify the authenticity of a software project on GitHub.

The use of legitimate, signed executables is a key part of this strategy. Because the files are signed by OpenAI or Anthropic, many basic security checks will not flag them as suspicious. This allows the malware to sit on a user's machine and load indirectly without triggering immediate alarms.

Security researchers note that this campaign shows how attackers can use trusted platforms to distribute malware in a way that looks believable. By packaging their code with well-known software names, they lower the chances of being caught. This creates a significant risk for users who download tools from unofficial sources to get early access to AI features.