Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Summary
Threat actors are distributing malicious loaders and cryptocurrency miners disguised as AI desktop applications for ChatGPT and Claude. These fake apps are part of a campaign dubbed Yoba and are delivered through fraudulent GitHub projects.
IFF Assessment
This campaign represents an ongoing threat as attackers leverage popular AI tools to trick users into installing malware, increasing the risk of compromise and resource hijacking.
Defender Context
Defenders should be aware of this evolving tactic, where legitimate-looking AI applications can be a vector for malware. Users should be cautioned about downloading AI tools from unofficial sources, and organizations should consider implementing stricter endpoint security measures and user education to prevent the execution of unauthorized or malicious software.