Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Yoba is the named operation in which threat actors deliver malicious loaders and cryptocurrency miners disguised as AI desktop applications.
- GitHub projects are fabricated to claim they are desktop applications for Claude and ChatGPT.
- Claude is Anthropic's product targeted by fake desktop apps that abuse signed executables to deploy cryptocurrency miners.
- ChatGPT is OpenAI's product targeted through the same fake-app scheme, which carries malicious loaders and cryptocurrency miners.
Why it matters: Claude and ChatGPT users bear the direct exposure because the campaign places malicious loaders and cryptocurrency miners inside fake GitHub projects claiming to be the two desktop applications. Repository discovery is therefore part of the attack surface: a project presented as an AI client carries unwanted mining code and loader payloads rather than only the promised application.
Ask SkimNews
