Yoba malware hides in fake desktop versions of ChatGPT and Claude

Check Point researchers have tracked a malware campaign dubbed Yoba for the past two months in which fake GitHub projects posing as desktop versions of ChatGPT and Claude spread a chain ending in a cryptocurrency miner. The operator set up repositories and GitHub.io pages for supposed apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus and hosted the malware as ZIP releases on GitHub.

Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months. Its operator set up repositories and GitHub.io pages for supposed apps called GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and hosted the malware as ZIP releases on GitHub. “While the repositories do … More https://www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer/ The post Yoba malware hides in fake desktop versions of ChatGPT and Claude https://www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer/ appeared first on Help Net Security https://www.helpnetsecurity.com .