Fake ChatGPT and Claude Apps Deploy Crypto Miners — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Yoba is the name of the campaign in which threat actors deliver malicious loaders and cryptocurrency miners disguised as AI desktop applications.
- ChatGPT and Claude are the products the fake apps impersonate, attaching OpenAI's and Anthropic's names to a malware distribution effort.
- GitHub projects are created and labeled as desktop applications, giving the campaign a plausible distribution channel for developers hunting AI builds.
- Signed executables in the fake ChatGPT and Claude apps are abused to deploy cryptocurrency miners, turning the lure into an installed miner.
Why it matters: Developers seeking unofficial Claude or ChatGPT desktop builds are the ones exposed: the lure is a fake GitHub repository, and the payload ships through signed executables inside apps named for those products. For Anthropic and OpenAI, the material cost is brand-level, with malware campaigns attached to their names while the machines that install the fakes run cryptocurrency miners.
Ask SkimNews
