Fake ChatGPT and Claude Apps Use Trusted Software to Load Yoba Malware

Check Point researchers found fake ChatGPT and Claude desktop apps promoted through GitHub pages ranking in Google results, offering supposed ‘GPT-5.6 Sol,’ ‘GPT-6 Astra,’ and ‘Claude Opus’ downloads. The packages run genuine signed OpenAI and Anthropic executables but sideload a malicious DLL, YobaDropper, which installs a loader that fetches further payloads — researchers observed the XMRig cryptominer — and can deliver other executables and PowerShell payloads. Neither OpenAI nor Anthropic was compromised; the campaign abuses their signed software to look legitimate.