A signature on a program tells you who built it, not whether it is safe to run. The campaign described by Check Point makes that distinction painfully clear. Attackers distributed fake ChatGPT and Claude desktop applications through GitHub, bundling legitimate signed OpenAI and Anthropic executables with a malicious dynamic link library. The trusted binary did the heavy lifting of looking legitimate while the hostile component rode along behind it.
The technique is DLL sideloading, and it is not new. The signed Setup.exe files loaded the malicious YobaDropper component, which then checked the name of its host process, whether it held administrator privileges, and keyboard layouts so it could avoid machines in Commonwealth of Independent States countries other than Ukraine. Lengthy sleeps frustrated automated analysis. Each of these checks is a small obstacle designed to keep the sample away from researchers, and together they show a deliberate effort to survive scrutiny.
The delivery method deserves equal attention. Some of the repositories reportedly appeared among Google's top results, most likely through search engine optimization poisoning. Check Point says the campaign has been tracked for two months and that an earlier variant posing as the Cursor coding agent appeared in early June. That timeline suggests the actor is iterating, and the fake AI brand names are chosen precisely because developers and curious users are eager to try them.
Check Point's advice is sensible: be cautious with AI applications from unverified repositories and restrict execution of software from unknown sources. But advice alone places the burden on individual users who are often least equipped to verify a binary's contents. Platforms that host such repositories and search providers that rank them should be pressed to act faster on impersonation of major AI products. Organizations should also enforce application allowlisting so that unfamiliar executables cannot start simply because they carry a recognizable signature.
The observed payload was an XMRig cryptominer, a relatively modest outcome. Yet the researchers warn that YobaLoader is a generic loader, so future waves could deliver other executables or PowerShell payloads. A cryptominer today is a warning sign, not the ceiling of the threat. The lesson for defenders is to stop treating a valid signature as a reason to trust, and to watch what signed programs load and where they persist.