Fake ChatGPT and Claude Apps Use Signed Executables to Install Yoba Malware

Check Point researchers uncovered the Yoba campaign distributing counterfeit “ChatGPT/Claude” desktop apps on GitHub; packages include legitimately signed executables that DLL-sideload a malicious DLL (YobaDropper) which demands elevation, establishes persistence, and loads YobaLoader. The loader derives C2 domains from a Telegram profile image, queries DNS-over-HTTPS for encrypted instructions, retrieves payloads (observed delivering an XMRig cryptominer via Tor and supporting EXE/PowerShell payloads), and uses Catbox for payload hosting—demonstrating evasion (signed binaries) and flexible post-compromise capabilities. Users are advised to obtain AI tools from verified sources and restrict execution of untrusted installers.