// ClaudeMEDIUM
Researchers discovered a malware campaign distributing Yoba malware via fraudulent GitHub projects claiming to offer non-existent Claude Opus, GPT-5.6 Sol, and GPT-6 Astra desktop applications. Attackers repackaged legitimate digitally-signed ChatGPT and Claude binaries with malicious DLLs to perform DLL sideloading. While Claude and OpenAI services were not compromised, the campaign exploited growing user interest in AI tools through SEO poisoning and malvertising to distribute the Yoba dropper, which establishes persistence via scheduled tasks and downloads cryptocurrency mining payloads.
- Hackers Use Signed ChatGPT and Claude Binaries to Deploy Yoba Ma(opens in a new tab)
- Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries(opens in a new tab)
// Get alerts for Claude