Malicious AI Desktop Applications Exploit Signed Executables for Crypto Mining Campaign

Threat actors are distributing malicious loaders and cryptocurrency miners through fake GitHub projects masquerading as AI desktop applications for ChatGPT and Claude. The Yoba campaign exploits signed executables to deploy malware, leveraging AI-themed deception to compromise systems.

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.

The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called

Read original article