Hackers Abuse Signed ChatGPT and Claude Apps to Deploy Yoba Malware
Attackers distribute Yoba malware through fake signed AI application downloads using DLL sideloading on Windows systems.
65
Product
Windows Media Player
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 28, 2026
- Last mentioned2h ago
Timeline
2 articles · newest firstFake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
68
Appears with
- Claudeproduct · 2
- ChatGPTproduct · 2
- Anthropicvendor · 2
- Yobamalware · 2
- OpenAIvendor · 2
- Check Point Researchorganization · 1
- YobaDroppermalware · 1
- XMRigmalware · 1
- YobaLoadermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.