Check Point reported on October 27 that attackers distributed a malware chain using fake ChatGPT and Claude desktop applications hosted on GitHub. The company calls the campaign Yoba and said it had tracked it for two months. An earlier variant posing as the Cursor coding agent appeared in early June, according to the report.
The fake projects impersonated AI applications, including GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Some GitHub repositories with GitHub Pages landing pages appeared among Google's top results. Check Point said this was most likely due to search engine optimization (SEO) poisoning.
The fake applications bundled legitimate signed OpenAI and Anthropic executables with a malicious dynamic link library (DLL). Check Point found that the signed Setup.exe files loaded the malicious component through DLL sideloading, a technique the company said is often used to bypass security protections.
The malicious DLL, which Check Point named YobaDropper, ran several checks before deploying a second-stage loader. It checked the name of its host process and whether it had administrator privileges. It also checked keyboard layouts to avoid machines in Commonwealth of Independent States (CIS) countries other than