As cited
Copy frozen at (site build).
threat intel
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Check Point Research discovered a campaign called Yoba that distributes malware through fake GitHub repositories impersonating ChatGPT, Claude, and Cursor artificial intelligence (AI) applications. The malware uses DLL sideloading to load malicious payloads alongside legitimate, signed binaries from OpenAI and Anthropic, then establishes persistence via scheduled tasks and communicates with command-and-control infrastructure through Telegram, DNS over HTTPS (DoH), and Tor. The final payload observed was XMRig 6.26.0 cryptominers, though the loader is generic and can deliver other malware families.
Why it matters: Organizations and end users face risk from trojanized artificial intelligence (AI) tool installers on GitHub that appear legitimate due to signed binaries and SEO-poisoned search rankings; security teams should block these repositories and educate users to avoid downloading AI tools from unverified sources.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Check Point Research discovered a campaign called Yoba that distributes malware through fake GitHub repositories impersonating ChatGPT, Claude, and Cursor artificial intelligence (AI) applications. The malware uses DLL sideloading to load malicious payloads alongside legitimate, signed binaries from OpenAI and Anthropic, then establishes persistence via scheduled tasks and communicates with command-and-control infrastructure through Telegram, DNS over HTTPS (DoH), and Tor. The final payload observed was XMRig 6.26.0 cryptominers, though the loader is generic and can deliver other malware families.
Why it matters: Organizations and end users face risk from trojanized artificial intelligence (AI) tool installers on GitHub that appear legitimate due to signed binaries and SEO-poisoned search rankings; security teams should block these repositories and educate users to avoid downloading AI tools from unverified sources.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Check Point Research discovered a campaign called Yoba that distributes malware through fake GitHub repositories impersonating ChatGPT, Claude, and Cursor artificial intelligence (AI) applications. The malware uses DLL sideloading to load malicious payloads alongside legitimate, signed binaries from OpenAI and Anthropic, then establishes persistence via scheduled tasks and communicates with command-and-control infrastructure through Telegram, DNS over HTTPS (DoH), and Tor. The final payload observed was XMRig 6.26.0 cryptominers, though the loader is generic and can deliver other malware families.
Why it matters: Organizations and end users face risk from trojanized artificial intelligence (AI) tool installers on GitHub that appear legitimate due to signed binaries and SEO-poisoned search rankings; security teams should block these repositories and educate users to avoid downloading AI tools from unverified sources.
- Source published
- First seen by Cybersecurity Tracker