Fake AI Desktop Apps Deploy Crypto Miners via Signed Executables

According to a report published by The Hacker News, threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family designed to mine cryptocurrency.

The counterfeit applications are distributed via fake GitHub repositories, targeting users seeking AI-powered desktop tools. A key technical detail noted in the report is the abuse of signed executables, which allows the malware to bypass security controls that might otherwise block unsigned or unknown binaries. Once executed, the loaders deploy cryptocurrency miners that abuse system resources, leading to potential performance degradation and increased electricity consumption on affected machines.

The report indicates that the campaign has been active as of the reporting date, with fake projects mimicking recent AI model releases. While the specific threat actor group behind Yoba is attributed broadly to the campaign name, details regarding exact malware variants, precise distribution volume, and specific victim counts remain unconfirmed and pending further analysis. Security researchers advise that users download AI applications only from official sources and verify publisher signatures to mitigate the risk of execution.