Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
64
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenOct 27, 2026
- Last mentioned1d ago
Timeline
6 articles · newest firstFake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
68
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
74
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
68
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Check Point says the chain uses signed OpenAI and Anthropic binaries plus Telegram, Tor, Catbox and DNS over HTTPS.
74
Appears with
- ChatGPTproduct · 6
- YobaLoadermalware · 6
- Claudeproduct · 6
- XMRigmalware · 5
- Anthropicvendor · 5
- OpenAIvendor · 5
- YobaDroppermalware · 5
- Check Pointorganization · 3
- Check Point Researchorganization · 3
- Cursorproduct · 2
- GPT-6 Astraai model · 1
- Sophosorganization · 1
- QiAnXinorganization · 1
- GPT-5.6 Solai model · 1
- Claude Opusai model · 1
- Beaglemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.