Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Threat actors are using fake desktop applications for AI tools to deploy malware. They create fake GitHub projects that appear to be legitimate desktop applications, such as those for Anthropic Claude and OpenAI ChatGPT. These projects actually deliver malicious loaders and cryptocurrency miners as part of a campaign. The malware is disguised as signed executables, adding to its deceptive nature. The campaign involves fake applications with names like GPT-5.6 Sol and Claude Opus. The malware family being delivered is associated with the Yoba campaign.