Fake ChatGPT Claude apps deploy crypto miners via signed executables

Threat actors created fake GitHub projects impersonating OpenAI ChatGPT and Anthropic Claude desktop applications to distribute malicious loaders and cryptocurrency miners in a campaign dubbed Yoba. The malware leverages signed executables to evade detection and establish persistence. Users downloading these counterfeit applications from unofficial sources are at risk. Defenders should warn users to only download AI applications from official vendor repositories and marketplaces.