![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/fake-chatgpt-claude-github-downloads-yoba-scam-illustration.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nResearchers found malicious packages behind familiar AI names<\/h3>\n
On October 27, 2026, Check Point Research documented Yoba malware<\/a> distributed through fake AI application repositories and GitHub Pages sites.<\/p>\n The lures borrowed names including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Their presence on GitHub did not make them official OpenAI or Anthropic releases.<\/p>\n The important finding was inside the package: a genuine, digitally signed executable sat alongside a malicious DLL. Running the trusted-looking program could load the other file.<\/p>\n Check Point observed cryptocurrency mining after infection. Its plain-language campaign summary<\/a> also explains that the loader can deliver additional payloads.<\/p>\n A publisher name in Windows can answer who signed that particular executable. It does not certify every neighboring file, the archive, or the repository distributing it.<\/p>\n You can recognize the publisher of Setup.exe and still miss the dangerous file beside it. Checking that signature alone leaves the rest of the package unverified.<\/p>\n This finding does not mean ChatGPT, Claude, GitHub, OpenAI, or Anthropic was compromised. The malicious distribution package is the problem.<\/p>\n The image above is an illustrative release page, not a recovered malicious website. Its address, release date, version, and file sizes are fictional.<\/p>\n The lure meets a straightforward need: someone wants an AI tool on their Windows desktop. A downloadable release seems quicker than sorting through competing search results.<\/p>\n Release notes and an app icon can make a repository feel familiar. They do not tell you whether its owner represents the AI developer.<\/p>\n Ask a narrower question than whether the page looks professional: did the genuine developer direct you to this exact account and release?<\/p>\n Follow the route outward from the developer’s website. Starting at an unknown download page and looking for reasons to approve it reverses that check.<\/p>\n A ZIP can feel like packaging rather than software. You extract it, see Setup.exe, and assume the other files are ordinary installation components.<\/p>\n In this campaign, the neighboring DLL mattered. You did not need to deliberately open that DLL for it to become part of the execution chain.<\/p>\n Do not copy the setup file into another folder and experiment. Altering the package is not a dependable way for a home user to make it safe.<\/p>\n There is also no need to test whether a suspicious app really answers prompts. A working interface would not establish that its installation was harmless.<\/p>\n The technique is often called DLL sideloading. In everyday terms, a legitimate program starts and brings another file into the process.<\/p>\n If that companion file belongs to the attacker, the useful reputation of the first program does not protect you from the second.<\/p>\n This explains why checking only Setup.exe can produce a comforting but incomplete answer. The question is what the supplied package will cause Windows to run.<\/p>\n Do not whitelist the folder, disable antivirus, or dismiss a detection because the installer shows a recognized publisher. Those actions remove useful checks at precisely the wrong moment.<\/p>\n An elevation request asks for more than permission to try an app. It can give a process broader ability to change the computer.<\/p>\n Cancel if the source remains uncertain. A message saying administrator privileges are required is a demand from the package, not independent evidence that granting them is appropriate.<\/p>\n On a work laptop, ask IT to approve the exact product and distribution source. A personal search result should not decide what receives elevated access.<\/p>\n The reported chain used scheduled persistence. Closing the visible setup window therefore cannot be treated as undoing everything it started.<\/p>\n That distinction changes the response. Deleting the ZIP removes the original delivery file, but it does not establish that later components or scheduled activity have disappeared.<\/p>\n Record when you ran the download and whether you approved an administrator prompt. Those facts help a technician investigate more effectively than guessing from the filename alone.<\/p>\n The observed mining component could pause when the user was active. A machine that feels normal during a quick check is therefore not cleared by that experience.<\/p>\n Fan noise, heat, or resource use can be clues, but they have many other causes. Neither their presence nor their absence diagnoses this campaign.<\/p>\n The loader also means the investigation should not end with the word miner. Establish what actually ran on the affected computer before deciding its exposure was limited.<\/p>\n Open a fresh browser window and reach the AI developer through an address you already know. Find its downloads or help area there.<\/p>\n If an official page links to an app store or repository, follow that link. Compare the complete publisher account, not just an icon or product name.<\/p>\n When you cannot find the claimed release through the developer, leave the downloaded package unopened. You do not owe an unknown uploader a chance to prove itself.<\/p>\n A new model name can make hesitation feel like missing out. Treat that feeling as a reason to slow down, especially when the download promises early access.<\/p>\n Do not send a private company installer or confidential archive to public analysis services without permission. IT can preserve and examine it through an approved process.<\/p>\n For a family member, explain the actual trap: the familiar signed file can be only one part of the download. That is more useful than saying GitHub is unsafe.<\/p>\n If nothing was executed, avoid assuming the computer is infected solely because the file was downloaded. Keep security software current and remove the unopened package after any needed reporting.<\/p>\n If execution is uncertain, say so. An honest timeline with gaps is safer than telling a technician the computer is clean because no app window appeared.<\/p>\n A bank alert does not prove Yoba caused a loss. Preserve both records so the relevant providers can investigate instead of tying unrelated events together.<\/p>\n These checks support an investigation. A clean scan cannot certify that a loader never ran, that no information left the device, or that every persistence method is gone.<\/p>\n On managed equipment, let IT handle containment and recovery. For a personal PC, seek qualified help if sensitive accounts, persistent detections, or administrator access were involved.<\/p>\n Microsoft describes the offline scan and its restart in the Windows Security scan guidance<\/a>.<\/p>\n If Malwarebytes is used, obtain it through the established MalwareTips download route<\/a>, rather than another search ad or an unexpected support message.<\/p>\n Its Custom Scan instructions<\/a> lead through the Scanner tile’s three-dot menu, Advanced Scan, and Custom Scan. Configure the relevant drives before starting.<\/p>\nThe signature belongs to a file, not the whole download<\/h3>\n
What deserves a second look before installation<\/h3>\n
\n
How the Fake AI Download Scam Works<\/h2>\n
Step 1: A search for an AI app leads to an unofficial release<\/h3>\n
Step 2: The archive makes the installer look routine<\/h3>\n
Step 3: A genuine executable loads code from the wrong source<\/h3>\n
Step 4: An administrator prompt raises the stakes<\/h3>\n
Step 5: The infection can outlast the first launch<\/h3>\n
Step 6: Mining can stay quiet while you use the computer<\/h3>\n
How to Check an AI App Without Testing the Suspicious Download<\/h2>\n
What to Do if You Downloaded or Ran the Fake App<\/h2>\n
\n
Checking a Windows PC After the Installer Ran<\/h2>\n
\n