Researchers at Check Point have identified a malware campaign, dubbed "Yoba," that distributes fake ChatGPT and Claude desktop applications through GitHub projects with names like "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus" — and the download packages work specifically because they bundle a legitimate, signed OpenAI or Anthropic executable alongside a malicious file that rides along with it (The Hacker News, 2026). If anyone on your team has ever searched for "ChatGPT desktop app" or "Claude desktop download" and picked a result that looked credible, this is exactly the scenario that story describes.
How Does a Fake AI App Get Past Basic Security Checks?
The trick is pairing a real, properly signed executable with a malicious DLL file that the signed program loads automatically — a technique called DLL sideloading. Each download package contains a genuine OpenAI Codex or Claude installer (Setup.exe) alongside a file named winmm.dll that isn't part of the real software at all. Because the visible, signed file is authentic, basic security checks and a cautious glance at the file list don't raise an obvious red flag, even though the folder also contains something that shouldn't be there.
What Actually Happens After Someone Installs One of These?
Once installed, the malicious DLL checks that it's running alongside the correct signed executable, then waits roughly 12.7 days before taking any further action — a deliberate delay designed to separate the infection from the download in anyone's memory and in basic security monitoring timelines (The Hacker News, 2026). After that delay, it copies a second malicious component into a new folder, sets up a scheduled task so the fake app keeps relaunching the payload automatically, and ultimately reaches out to a Telegram channel and uses Google's own DNS-over-HTTPS service to quietly fetch its next set of instructions — a method chosen specifically to blend in with ordinary, trusted network traffic rather than trigger security gateway alerts. The end result is a cryptocurrency miner injected into a legitimate Windows system process, quietly using company hardware to generate cryptocurrency for the attacker.
How Widespread Is This Right Now?
The exact scale isn't public — Check Point's research doesn't report download counts, infection numbers, or a list of affected organizations. What is known is the campaign's timeline: the first GitHub repository behind this went up around July 2026, with the actual malicious releases not appearing until the end of August, and the technique has continued to evolve since, with newer versions removing some of the anti-detection checks earlier versions had included. Reporting also notes that infected machines using certain regional keyboard layouts are deliberately skipped, consistent with the operators avoiding specific geographic regions — a pattern researchers often associate with the attacker's own location, though it's not confirmed here.
Why Does This Matter for a Business That Doesn't "Officially" Use AI Tools?
Because employees experimenting with AI tools on their own initiative — exactly the behavior behind the shadow AI trend — is precisely the scenario this campaign is built to exploit. Someone who wants to try the newest version of ChatGPT or Claude and searches for a desktop app rather than going directly to a known, official source is the specific target here, and a company with no policy on which AI tools employees are allowed to use, and no guidance on where to get them, has no real defense against this particular trick beyond luck.
What Should a Business Actually Do About This?
The only fully reliable download path for ChatGPT or Claude desktop software is the official site of the company that makes it — openai.com or claude.ai — not a GitHub project, a search result, or a link shared in a chat or forum, regardless of how convincing the project page looks. IT teams should treat any AI desktop application installed outside that path as suspicious by default, and it's worth checking now whether any machines on your network have an AI "app" installed that didn't come through an approved channel. Pairing that with a basic AI-use policy — which tools are approved, and where to get them — closes the gap this entire campaign depends on.
Frequently Asked Questions
What is the "Yoba" malware campaign?
Yoba is a malware campaign identified by Check Point Research that distributes fake ChatGPT and Claude desktop applications through GitHub, bundling a legitimate signed AI company executable with a hidden malicious file that ultimately installs a cryptocurrency miner.
How does the malware get past antivirus or basic security checks?
It uses DLL sideloading — pairing a real, properly signed executable from OpenAI or Anthropic with a malicious file that the signed program loads automatically, which makes the package look legitimate at a glance since the visible file genuinely is authentic.
What does this malware actually do once installed?
After a delay of roughly 12.7 days, it installs additional components, sets up a scheduled task for persistence, and ultimately injects a cryptocurrency miner into a legitimate Windows system process, using the infected computer's resources to mine cryptocurrency for the attacker.
How can I be sure I'm downloading a real ChatGPT or Claude app?
Only download desktop AI applications directly from the official company websites — openai.com for ChatGPT or claude.ai for Claude — never from a GitHub project, search result, or third-party link, regardless of how legitimate the page appears.
Is this risk limited to employees who officially use AI tools at work?
No. This campaign specifically targets employees experimenting with AI tools on their own, which is common even at companies with no official AI tool deployed — making an AI-use policy and awareness of safe download sources relevant to every business, not just ones actively rolling out AI software.