Yoba malware spreads via fake desktop versions of ChatGPT and Claude

# Yoba malware spreads via fake desktop versions of ChatGPT and Claude

https://gcdradar.vercel.app/incidents/yoba-malware-spreads-via-fake-desktop-versions-of-chatgpt-an · AIR-2026-1638 · closed 2026-11-12

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world malicious campaign spreading cryptocurrency miners.
- Fix status: No fix needed
- First reported: 2026-10-29
- AI role: No AI role
- Products: ChatGPT, Claude

## Summary

Threat actors are distributing the Yoba malware chain disguised as desktop versions of ChatGPT and Claude on GitHub. The fake projects deliver cryptocurrency miners to victims.

## What to do

Do not download unofficial desktop clients for AI applications from GitHub repositories.

## Latest updates

- 2026-10-29: Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners (https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html)
- 2026-10-29: Yoba malware hides in fake desktop versions of ChatGPT and Claude (https://helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer)

## Sources

- 2026-10-29 Help Net Security: Yoba malware hides in fake desktop versions of ChatGPT and Claude https://helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer
- 2026-10-29 The Hacker News: Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.