Hackers use fake ChatGPT and Claude apps to spread crypto mining malware
Check Point Research said threat actors are exploiting interest in artificial intelligence tools by distributing fake desktop apps that impersonate popular products such as ChatGPT and Claude. The campaign used bogus GitHub repositories to promote malware-laced programs with names including GPT-5.6 Sol, GPT-6 Astra and Claude Opus, while SEO manipulation helped malicious sites rank higher in Google search results. According to the report, the ZIP archives contained legitimately signed executable files bundled with malicious DLLs. Once a victim launched what appeared to be a normal application, the DLL was silently loaded through DLL side-loading, leading to the installation of the XMRig cryptocurrency miner. The malware then used the victim’s system resources to mine for the attackers and could pause mining activity when user activity was detected, a tactic designed to reduce the chance of discovery. Researchers said the first GitHub repository tied to the activity appeared in July 2026, with malicious downloads emerging in late August. While the current payload is a crypto miner, they warned that YobaLoader could later be used to deploy other forms of malware.
