Fake AI clients on GitHub infect victims with XMRig cryptominer

Check Point Research spotted a campaign using fake GitHub clients for GPT-5.6 Sol, GPT-6 Astra and Claude Opus, pushed to the top of Google via SEO poisoning. The downloaded Yoba malware establishes persistence and deploys the XMRig Monero miner.

• Fake clients for GPT-5.6 Sol, GPT-6 Astra and Claude Opus hosted on GitHub
• Yoba establishes persistence and can delay execution by two weeks to evade analysis
• Malware skips systems in Russia, Belarus, Kazakhstan and Uzbekistan
• Final payload is the Monero miner XMRig