Fake ChatGPT and Claude apps on GitHub hide a crypto-mining virus

Fake desktop apps for ChatGPT and Claude are being offered on GitHub, a site where programmers share code, and they show up near the top of Google results. Researchers at Check Point say each download holds a genuine installer from OpenAI or Anthropic with a malicious file hidden beside it. The file installs a cryptominer, a program that uses your computer's power to earn digital coins for someone else.

What happened

Check Point calls the campaign Yoba and says it has tracked it for about two months. The attackers built GitHub pages that look like official app sites. Their names borrowed AI buzz: GPT-5.6 Sol, GPT-6 Astra and Claude Opus. According to Check Point, the pages reached the top of Google likely through SEO poisoning, which means gaming search rankings. They did not even need fake stars to look popular.

How the trick works

The download is a ZIP file. Inside is the real Setup.exe, digitally signed, so Windows trusts it. Next to it sits a malicious file called winmm.dll. When the signed installer runs, it loads that file from the same folder. The signature covers the installer, not the file beside it.

The malware then asks for administrator rights. According to Gridinsoft, it installs itself in a folder called WMProcess and sets up a scheduled task disguised as Windows Media Player. That task restarts it after every reboot. It takes instructions through a Telegram channel and encrypted lookups via Google.

Why it matters

The final payload Check Point saw was XMRig, a miner that worked through Tor and paused while the user was active. That makes a slow PC easy to miss. The bigger worry is the loader. It is generic and could just as easily deliver password stealers or remote access trojans, which let a stranger control a computer. Check Point reported the miner, not those other tools.

Who is affected

The target is Windows users who search Google for ChatGPT or Claude desktop apps and click a GitHub page instead of the official source. The malware skips computers with Russian or other CIS keyboard layouts, except Ukraine. If you got your app from the maker's own page, you are not part of this campaign.

What to do and what comes next

The steps in the alert box above cover what to do, whether you only downloaded the ZIP or already ran it.

Expect more of the same. Infosecurity Magazine reports an earlier Yoba version posed as the Cursor coding agent in June. Recent fake Claude pages on claude.ai and a fake ChatGPT "Plus 5.6" model have also spread malware. The lures simply copy whatever product names people are searching for. A model name in a GitHub title is not proof of anything.