malicious loaders

Fake AI Desktop Apps Deploy Crypto Miners via Signed Executables

Threat actors have been distributing malicious loaders and cryptocurrency miners disguised as legitimate desktop applications for OpenAI ChatGPT and Anthropic Claude. The campaign, attributed to 'Yoba', involves creating fake GitHub projects mimicking AI tools such as GPT-5.6 Sol and Claude Opus. These counterfeit applications abuse signed executables to bypass security controls and deploy mining malware onto victim systems.