Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads

A malware campaign known as Yoba targets users by leveraging the popularity of AI tools like ChatGPT and Claude to trick them into installing infected software.

They publish fake GitHub projects that pose as desktop apps named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Because the projects sit on GitHub, a platform many developers trust, they look real to many visitors.

Anyone who runs the installer can give the operators control of their computer, so the risk is high for both home users and workplace devices.

ChatGPT Claude Malware

Check Point observed that the fake projects use GitHub Pages sites to describe the software and show download buttons. Those buttons point to ZIP files stored in GitHub releases. The repositories did not use fake stars or forks to look popular.

Even so, they appear near the top of Google results. Researchers believe this comes from SEO poisoning, a method where operators tune titles, descriptions, and hosting domains so search engines rank their pages higher.

The ZIP files also had no password protection. Operators often add a password so automated scanners cannot open the files, but these samples had low detection rates because of built-in anti-analysis checks.

This pattern is becoming common. Researchers at QiAnXin reported that fake DeepSeek TUI repositories hid malware inside a 7z archive on the Releases page, and that the same group also published counterfeit installers named after Claude, Grok, and WormGPT.

An earlier case involved a fake Claude website that offered a ZIP file called Claude-Pro Relay. Sophos researchers found that its installer dropped a backdoor called Beagle.

Readers who want more background can read this report on the DeepSeek TUI repositories and this report on the fake Claude site.

Signed Files Hide the Malicious Code

According to Check Point Research, each Yoba ZIP file holds a real, signed Setup.exe from OpenAI or Anthropic, along with a malicious winmm.dll. Researchers call this technique DLL sideloading. Windows loads a library by name from the folder where the program sits.

A rogue file placed in that folder can then run inside a trusted process. MITRE explains that this method hides malicious actions under a legitimate and trusted process, and that benign programs used this way often go unflagged. Many security tools trust signed software, which makes this method hard to spot.

The dropper, called YobaDropper, checks whether it runs under the expected name Setup.exe. If it runs alone in a sandbox, the check fails.

It also checks the victim’s keyboard language and skips systems set to Russian and several former Soviet region languages. If the user lacks administrator rights, it shows a message and stops.

When the rights are right, it creates a folder under ProgramData, copies a legitimate Windows Media Player file into it, and drops a second library called YobaLoader.

It then creates a scheduled task that starts three minutes after boot. The task is labeled as a Microsoft component, so it appears normal in the task list.

YobaLoader does not contact a fixed server. It reads the profile image of a Telegram channel, yoba_fanclub, and uses the last 50 bytes of that image to build a new domain name.

The domains follow a pattern such as adjective-noun-verb-number.dedyn.io. Changing the channel image creates a new domain, which makes blocking harder.

Next, the loader asks Google’s DNS-over-HTTPS service for a hidden command stored in a DNS TXT record. This traffic looks like normal encrypted web browsing.

The loader checks the command with an Ed25519 signature and decrypts it with AES. The command points to a file hosted on files.catbox.moe.

In this campaign, the final payload was an XMRig cryptocurrency miner that connected through Tor. Researchers warn that the loader is generic, so future waves may deliver other malware, including ransomware or data-theft tools.

The fake repositories used three email addresses, and their commit times point to time zones of UTC+4, UTC-4, and UTC+3. Researchers say this mix likely hides the operators’ real location.

The compile times of the malicious files point to UTC-4. Check Point also reports indicators that suggest Russian origins. These clues are useful, but they do not prove who is behind the campaign.

Earlier versions of YobaDropper appeared in early June 2026 and used a process named Cursor.exe, which shows the operators have changed their lure over time.

Users should download AI tools only from official company websites, such as openai.com or anthropic.com. Before running any download, check the repository owner, account age, commit history, and the number of real contributors.

Security teams should watch for signed programs that load DLL files from user folders, unknown scheduled tasks with Microsoft labels, and unusual DNS-over-HTTPS traffic.

Blocking unknown software sources and limiting administrator rights can also reduce damage. The MITRE guidance on DLL sideloading lists monitoring of DLL loads and new file creation as key steps.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads appeared first on Cyber Security News.