Check Point Research identified a campaign called Yoba that distributes malware through counterfeit ChatGPT and Claude desktop apps. The fake projects—named “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus”—use authentic GitHub infrastructure and SEO-poisoned pages to rank among top Google results. Downloaded ZIP files contain a legitimately signed Setup.exe from OpenAI or Anthropic alongside a malicious winmm.dll. When run, the signed executable sideloads the DLL, deploying a dropper that pauses for about 12 days, skips systems with CIS-region keyboard layouts, and demands administrator rights. The dropper copies a Windows Media Player binary to ProgramData, creates a scheduled task authored by Microsoft Corporation, and then loads a second DLL that contacts a Telegram-based channel, queries Google DNS-over-HTTPS for encrypted instructions, and fetches an XMRig cryptominer from Catbox. Researchers warn future waves could deliver other malware families, and the use of mainstream services makes detection harder. 1