# Fake AI desktop apps use signed executables to install cryptocurrency miners

_Published Thursday, October 29, 2026 at 12:32 PM EDT · Security · Latest · Tier 2 — Notable_

![Fake AI desktop apps use signed executables to install cryptocurrency miners — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1ij0gwe-L1jDZxdoUPZ6hpSJnJgMHh2bG8bFF2y8y-dJA9nY0Fr2JOU2i4NaCetGqvTZOtvaRXbZONR6d8ajjMR6DNm_X7OwaVCiH7dPycEN9xGI0psNvPYbwDhpGmUQ4Qyhp5x9fqQ_sgzjcReslK-a-gRS3kFr5_JOns1kkuC6UheDHVb2yaV8EAhIF/s1700-nu-rw-lo-l85-e365/claude-hack.jpg)

Attackers are distributing cryptocurrency miners through fake ChatGPT and Claude desktop applications hosted on GitHub, Check Point Research found. The campaign, called Yoba, packages malicious files beside legitimate signed OpenAI and Anthropic executables.

When the executable runs, it loads the adjacent malicious library, a technique called DLL sideloading. The infection installs a persistent loader that retrieves instructions through Telegram, generated domains and Google's encrypted DNS service before injecting an XMRig miner into a Windows process.

Check Point says these services help the traffic blend into normal activity. The malware also checks its host executable and skips machines with several specified keyboard layouts, complicating analysis and limiting its targets.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html)

---
Canonical: https://techandbusiness.org/newswire/7C3BPhcXld5FMFOoL8IVfp
Published: 2026-10-29T16:32:49.155Z
Story chronology: 2026-10-29T15:20:00.000Z
Retrieved: 2026-10-29T18:44:33.464Z
Publisher: Tech & Business (techandbusiness.org)