Fake ChatGPT and Claude apps use signed AI files to spread malware

How the attack worked

Attackers are distributing malware by bundling legitimate, digitally signed executables from OpenAI (ChatGPT) and Anthropic (Claude) with malicious files. According to Check Point Research↗ (opens in a new tab), these fake desktop applications are promoted through convincing GitHub repositories and websites. The sites use search engine optimisation (SEO) tricks to appear near the top of Google results, making them look credible to potential victims.

When a user downloads one of these fake apps, the installer package contains a real signed Setup.exe from OpenAI or Anthropic, along with a malicious file called winmm.dll. This technique, known as DLL sideloading, takes advantage of the way Windows applications load additional code. When the legitimate executable runs, it loads the malicious DLL, which Check Point calls YobaDropper.

The dropper waits about 12 days unless it is launched by a process named Setup.exe. It avoids infecting systems with Russian, Belarusian, Kazakh, or other CIS-region keyboard layouts. If it gets administrator rights, it copies a genuine Windows Media Player binary and a second malicious DLL into the ProgramData folder, then creates a scheduled task (appearing to come from Microsoft) to run the malware after each reboot.

What was taken

The main payload observed so far is XMRig, a cryptocurrency miner. This program uses the victim's computer to mine cryptocurrency for the attacker, often slowing down the system and increasing electricity use. Check Point warns that the loader can also download other types of malware, such as Windows executables or PowerShell scripts, so the impact could go beyond cryptomining in future attacks.

The response

Check Point researchers highlighted that the campaign, tracked as Yoba, demonstrates the limits of relying on digital signatures for trust. A valid signature proves the executable is genuine, but not that everything it loads is safe. Security Brigade's CTO, Yash Kadakia, said defenders should not rely solely on signatures and should monitor for suspicious DLL loading, scheduled tasks, and unusual network activity. He also advised organisations to make approved AI tools easier to access, to reduce the temptation for employees to download risky software from unofficial sources.

What you should do

For individuals, only download AI tools from official websites or trusted sources. For organisations, review administrator privileges, monitor for unexpected DLL loading and scheduled tasks, and extend application controls beyond just checking digital signatures. Developers are especially at risk, as their machines often hold sensitive code and credentials.

Has this happened before?

Check Point also found an earlier version of this campaign in June, using a fake Cursor AI coding-agent app. This shows attackers are likely to continue using fake AI tools to spread malware.