Hackers are using GitHub to push fake ChatGPT and Claude apps

A new malware campaign uses fake AI apps with names like "GPT-6 Astra", "GPT-5.6 Sol", and "Claude Opus" to infect victims and mine cryptocurrency.

The campaign uses fake GitHub projects to impersonate the applications, and doesn't need phishing emails, as the fake download pages rank prominently in search results - probably through the use of SEO poisoning.

In an advisory, researchers at Check Point said the campaign, dubbed Yoba, uses real OpenAI and Anthropic software, with each download including a genuine, signed ChatGPT or Claude installer. The package looks legitimate, but when the real app runs, the malware runs along with it.

Importantly, neither ChatGPT and Claude nor OpenAI and Anthropic have themselves been compromised. Instead, the attackers abuse legitimate signed binaries and the credibility associated with the brands.

“The AI boom is creating a new opportunity for cybercriminals: they can attack the trust surrounding AI without ever attacking the AI itself," said Eli Smadja, head of research at Check Point Research.

"Yoba shows how search results, recognised brands and even legitimately signed software can be combined to make malicious downloads appear credible."

Duping users

Check Point said Yoba uses several checks designed to complicate automated analysis before moving on to its second stage.

YobaDropper verifies that it was launched by the expected Setup.exe, introduces a lengthy delay if this check fails, applies regional language checks, and requires administrator privileges to continue.

Once these checks have been carried out, YobaDropper deploys YobaLoader alongside a legitimate Windows executable and creates a scheduled task that enables the legitimate executable to sideload YobaLoader after system startup.

It uses trusted internet services – such as Telegram, Google’s DNS-over-HTTPS service, and Catbox – to retrieve payloads, reducing its dependence on traditional command-and-control infrastructure and making malicious communications harder to distinguish from normal activity.

In this particular campaign, the final payload was XMRig 6.26.0, which is used to mine cryptocurrency. However, Smadja said the campaign “should not be viewed simply as cryptomining malware”.

“YobaLoader is a generic loader capable of delivering different Windows executable or PowerShell payloads, meaning the same infection chain could potentially be used to distribute other malware."

The hackers behind the campaign appear to have Russian origins, operating primarily in the UTC-4 time zone, and deliberately avoiding infecting computers set up for Russian and other CIS languages.

To avoid infection, organizations should verify AI software at the source, restrict unauthorized applications and administrator privileges and inspect downloads and application behaviour, Check Point said.

"As adoption accelerates, users and organisations need to verify AI software at its source and apply prevention-first controls to unauthorised applications and endpoint behaviour," said Smadja.

"In the AI era, knowing where your software came from may become just as important as knowing what it does."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.