Fake ChatGPT and Claude apps on GitHub are a miner behind a signed file

The demand for a desktop ChatGPT or Claude is a distribution channel. Check Point Research says a campaign it calls Yoba has been using that demand. GitHub projects, and matching pages on GitHub’s site, present themselves as desktop builds for model names people are already searching for, including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. What the archive carries, in Check Point’s account, is a loader. The end of the chain is a cryptocurrency miner.

The Hacker News reported the research on October 29, 2026. The first repository tied to the activity was created around July 2026. The malicious releases showed up later, toward the end of August.

This desk will not walk through the loader. The public impact is the part a defender can act on. The steps are how someone copies the campaign.

A signature covers one file

The archives pair a legitimately signed executable from OpenAI or Anthropic with a library the attacker supplied. The trusted program loads the attacker’s library. The technique is DLL sideloading, and it is older than this campaign. The model brand is the wrapping. The signature still belongs to the vendor. The code that runs next does not.

That is why “it was signed” fails as a triage rule. A signature says who built that one file. It does not say who chose the folder, or what else in the folder is loaded when the program starts. Application control that stops at the publisher of the executable will wave this through.

Check Point describes persistence as a scheduled task that starts a legitimate executable so the malicious library loads again. A later stage retrieves a miner in the XMRig family and runs it. The operators took trouble to make the retrieval look like ordinary web traffic. Naming that outcome is not a map of the infrastructure. Teams that need indicators should read Check Point’s report and hunt from their own telemetry, not from a paragraph in a news briefing.

The projects were not, in the researchers’ view, padded with fake followers. They were placed so a search for the model name would surface them. A short page describing “features” is cheap credibility. Search ranking does the rest. The repositories Check Point described did not share one contact address, and the upload times did not sit in one time zone. That is what a person does when the accounts should not look like one desk.

The loader has also skipped machines whose language settings match a set of countries, a habit familiar from other criminal campaigns, and earlier builds were pickier about analysis environments than later ones. A regional exception is not a reason to ignore the campaign everywhere else.

What a company should do

Assume someone on staff will search for a desktop build of whatever model was announced this month. Write the answer down before they do.

Official clients come from the vendor. OpenAI and Anthropic publish their own apps and their own download pages. A GitHub repository that claims a newer model number than the vendor has shipped, or a “free desktop” the vendor does not offer, is the lure. Say that in the same channel you already use for dependency advice. Developers live on GitHub. A repository looks like the place a desktop build would be. A vendor’s signed executable inside a stranger’s archive is a reason to stop.

Block the pattern where you can. Route software requests through the team that owns the endpoint. Alert when a signed vendor binary shows up in a user-writable directory beside a library that did not ship with it. Alert on a scheduled task the user did not create, and on a workstation whose CPU stays busy while it should be idle. Miners are loud if anyone is looking at the processor. They are quiet if the only control is a publisher check on the setup program.

Do not treat this month’s names as a fixed blocklist. GPT-5.6 Sol and Claude Opus are the bait in this report. The next repository will use the next name people are typing into a search box. The stable control is where software is allowed to come from.

This briefing relies on public reporting by The Hacker News and research from Check Point. It does not include malware procedures.