Live › campaign › CMP-202610-fake-chatgpt-and-claude-desktop-apps-on-github-gpt-5-6-sol-g
Check Point Research (27 Oct 2026) tracked the Yoba campaign for about two months. Fake GitHub repos and GitHub.io pages pushed up in Google results through SEO poisoning offer ZIP releases of made-up desktop apps (GPT-5.6 Sol, GPT-6 Astra, Claude Opus). Each ZIP holds a real, signed OpenAI Setup.exe or Claude executable plus a malicious winmm.dll, which the signed file loads (DLL sideloading). YobaDropper asks for admin rights and adds a scheduled task so YobaLoader starts at boot. YobaLoader turns a Telegram channel's profile image into a domain, fetches a TXT record through Google DNS-over-HTTPS and downloads an encrypted payload from Catbox. In the samples seen, the payload was the XMRig 6.26.0 miner over Tor, but the loader can run any EXE or PowerShell payload. An earlier version posing as the Cursor coding agent appeared in early June. At risk: staff who download AI desktop apps from search results or GitHub instead of the vendor's site. OpenAI and Anthropic were not compromised.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:48 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ChatGPT Desktop | – | – | – |
| Claude Desktop | – | – | – |
| Windows | – | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202610-fake-chatgpt-and-claude-desktop-apps-on-github-gpt-5-6-sol-g")