Fake AI desktop apps use signed executables to install cryptocurrency miners

Attackers are distributing cryptocurrency miners through fake ChatGPT and Claude desktop applications hosted on GitHub, Check Point Research found. The campaign, called Yoba, packages malicious files beside legitimate signed OpenAI and Anthropic executables. When the executable runs, it loads the adjacent malicious library, a technique called DLL sideloading. The infection installs a persistent loader that retrieves instructions through Telegram, generated domains and Google's encrypted DNS service before injecting an XMRig miner into a Windows process. Check Point says these services help the traffic blend into normal activity. The malware also checks its host executable and skips machines with several specified keyboard layouts, complicating analysis and limiting its targets.