Check Point Research said threat actors are exploiting interest in artificial intelligence tools by distributing fake desktop apps that impersonate popular products such as ChatGPT and Claude. The campaign used bogus GitHub repositories to promote malware-laced programs with names including GPT-5.6 Sol, GPT-6 Astra and Claude Opus, while SEO manipulation helped malicious sites rank higher in Google search results.
According to the report, the ZIP archives contained legitimately signed executable files bundled with malicious DLLs. Once a victim launched what appeared to be a normal application, the DLL was silently loaded through DLL side-loading, leading to the installation of the XMRig cryptocurrency miner. The malware then used the victim’s system resources to mine for the attackers and could pause mining activity when user activity was detected, a tactic designed to reduce the chance of discovery.
Researchers said the first GitHub repository tied to the activity appeared in July 2026, with malicious downloads emerging in late August. While the current payload is a crypto miner, they warned that YobaLoader could later be used to deploy other forms of malware.
Check Point Research said hackers are riding the popularity of artificial intelligence tools by distributing fake desktop applications that imitate well-known products including ChatGPT and Claude, using them to deliver cryptocurrency mining malware.
The researchers said the attackers set up fake GitHub repositories to promote bogus apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. They also used SEO manipulation to push malicious websites higher in Google search results.
The malicious ZIP archives contained legitimately signed executable files bundled with harmful DLLs. After a user launched what looked like a legitimate application, the malicious DLL was silently loaded through DLL side-loading, which then installed the XMRig cryptocurrency miner and used the victim’s resources to mine for the attackers.
Check Point Research added that the malware could pause mining when it detected user activity, helping it avoid detection.
On the timeline, the first GitHub repository linked to the campaign appeared in July 2026, and malicious downloads began to emerge in late August. Researchers warned that although the current payload is a crypto miner, YobaLoader could be used in the future to deploy other types of malware.
The report was cited by U.Today.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
