Attackers use a malware campaign known as Yoba to compromise systems by distributing fake desktop versions of ChatGPT and Claude. Security researchers say the scheme relies on counterfeit GitHub projects that appear to be legitimate applications, with the malware ultimately leading to a cryptocurrency miner.
Both reports describe attackers creating repositories and hosting ZIP releases on GitHub, including pages intended to look like downloadable desktop products. The Help Net Security piece adds that the campaign has been tracked for about two months and that named fake app releases include versions branded as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus.” Infosecurity Magazine emphasizes that the malicious payload is wrapped in binaries that are presented as signed ChatGPT and Claude executables, reflecting how the attackers try to appear more trustworthy. Together, the coverage highlights social-engineering tactics and GitHub hosting methods used to disguise malware distribution.
