Fake ChatGPT, Claude apps spread malware via signed AI binaries
Summary
Attackers are distributing malware through fake ChatGPT and Claude desktop applications by bundling legitimate, digitally signed executables from OpenAI and Anthropic with malicious files. This campaign, known as Yoba, uses SEO poisoning to lure victims to fake GitHub repositories and websites, ultimately deploying a cryptocurrency miner and potentially other malware through DLL sideloading.
IFF Assessment
This article describes a malicious campaign that exploits trusted AI application names and legitimate signed binaries to distribute malware, posing a direct threat to users and their systems.
Defender Context
Defenders should be aware of sophisticated social engineering tactics that leverage the popularity of AI tools like ChatGPT and Claude. The use of signed binaries by attackers highlights the need for robust endpoint detection and response (EDR) solutions capable of identifying anomalous process behavior and DLL sideloading, even when legitimate-looking executables are involved.