Fake ChatGPT and Claude apps spread malware via signed OpenAI and Anthropic binaries

Check Point Research detailed the Yoba campaign, in which fake GitHub repos and sites promote bogus apps like "GPT-5.6 Sol," "GPT-6 Astra" and "Claude Opus." The installers pair genuine signed OpenAI and Anthropic Setup.exe files with a malicious winmm.dll, using DLL sideloading and delivering an XMRig miner as the final payload.

• Installers bundle a genuine signed Setup.exe with a malicious winmm.dll
• The dropper stalls about 12 days and skips CIS keyboard layouts
• Stage two pulls commands via Telegram, DNS TXT records and Catbox
• Final payload is XMRig, but the loader can fetch other malware