Check Point: Yoba malware hid behind genuine signed OpenAI and Anthropic files in fake ChatGPT and Claude apps
Check Point Research says fake GitHub projects named GPT-6 Astra, GPT-5.6 Sol and Claude Opus shipped genuine signed OpenAI and Anthropic files beside a malicious DLL that ends in an XMRig miner. It says neither company was compromised and prints no victim count. Read 29 October 2026.
By Parminder Kumar Sharma · LinkedIn · · 19 min read
A valid signature, and a DLL built 85 seconds before it was posted
Check Point Research's report on a malware chain it calls Yoba contains two timestamps that sit side by side. The malicious file in the ChatGPT themed ZIP, winmm.dll, has a compilation time of 19:14:19 UTC on 30 August 2026. The release that carried it, sol-setup.zip on GitHub, was uploaded at 19:15:44 UTC the same day. That is 85 seconds (derived). Beside it in the archive sits a genuine executable that the report says is signed by OpenAI, and the panel Check Point prints for it reads "Signed file, valid signature". A signature check on that executable passes. The file doing the damage is the one next to it.
What that does not establish: it does not show that OpenAI or Anthropic was compromised, and the Check Point blog post says its research "does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised". It does not give a victim count, a country list or a loss figure, because the report prints none. It does not say whether the repositories are still up, and it is silent on any statement from OpenAI, Anthropic or GitHub. Compile times are written by whoever builds a file, so the 85 seconds is a reading, not a proof of when anyone ran anything.
This briefing is built on Check Point's own report, Tricks from the Past deployed via signed ChatGPT and Claude binaries, dated 27 October 2026, and its blog summary of the same day, both read in full with their figures. Help Net Security, 29 October 2026, was read in full as the pointer. The Hacker News piece that was also named as a lead answers automated reads with a block and was not read. OpenAI's own pages (openai.com and help.openai.com) answered automated requests with block pages that were not bypassed, so nothing here is taken from OpenAI's download page; Anthropic's download page was read. Reading ran from 18:25 to 18:36 GMT on Thursday 29 October 2026.
One interest to state. Check Point sells endpoint security and threat intelligence, and its blog post names its own products as relevant controls, so the analysis is a vendor's analysis, not a court finding or a statement by the impersonated companies. OpenAI and Anthropic appear only as impersonated brands; each sells the genuine apps and has an interest in downloads coming from its own channels. Neither is accused of anything in the sources.
How a victim gets from a search result to a miner
Check Point describes fake GitHub repositories and GitHub Pages sites for supposed desktop apps called "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus". The pages carry download links that point to ZIP files attached as GitHub releases. The report says there is no sign of fake engagement such as inflated stars or forks, yet the pages "still appear among the top results on Google", which it calls "most likely" SEO poisoning. That is the report's inference. It names no search advert, social post or email as a lure, so none can be claimed here.
The first figure above shows the genuine OpenAI result listed above the GitHub one for the query "GPT 6 Astra download free". The fake did not need to outrank the vendor to be seen, and a reader who searched for a download rather than a model page was shown a download guide. The repository in Check Point's Figure 2 describes itself in its About line as a way to "Download and install GPT-Sol on Windows 10 and 11 using a single PowerShell command". The report's own account of delivery is a ZIP release, and it does not analyse any PowerShell install command, so what that line led to is not stated.
The figure shows 2 stars and 0 forks, which fits the report's statement that engagement was not inflated. The release assets, not the repository, carried the malware: the report lists sol-setup.zip uploaded 30 August 2026, Setup-Claude.zip uploaded 31 August and GPT-6-Astra-Setup.zip uploaded 4 September, Check Point says the repositories did not password protect their ZIPs, as such files often are. Its reason is that detection was already low. A multi engine scan listing in its Figure 6 shows 1 of 67, 0 of 55 and 1 of 68 detections for the three ZIPs (read from the screenshot, which does not name the scanner or the date it was taken).
What "signed" means here, and what it does not
Each archive, the report says, "contains a legitimate executable signed by OpenAI or Anthropic" (Help Net Security's wording of the finding) packaged with a malicious DLL that the executable loads when run. The report's text says Setup.exe in the ChatGPT ZIPs is a legitimate signed OpenAI executable and that Setup-Claude.zip has the same structure with a legitimate signed Claude executable. This is DLL sideloading: Windows looks for a library such as winmm.dll in the folder the program was started from, and the attacker supplies one there.
Read the panels as the report prints them. The OpenAI file is not named ChatGPT in its metadata: it reads Product "Codex", Original Name "notification_helper.exe". The Anthropic file reads Product "Claude", Original Name "claude.exe". Both say a valid signature exists; the signers are "OpenAI OpCo, LLC" (chained through Microsoft's verified code signing authority) and "Anthropic, PBC" (chained through DigiCert). Check Point says the actor abuses "legitimate signed binaries and the credibility associated with these brands" and that its research does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised.
What a valid signature on the executable establishes, and what it does not, from Check Point's report, blog post and Figure 7. Derived items are marked.
| The question | What the record shows | What it does not establish |
|---|---|---|
| Who signed the file? | OpenAI OpCo, LLC and Anthropic, PBC, with valid signatures (Figure 7). | That the folder, ZIP or website the file arrived in came from either company. |
| Is the rest of the package covered? | Check Point: a valid signature "can establish the legitimacy of an individual executable, but not of every component packaged alongside it". | Whether winmm.dll carries any signature. The report does not say. |
| Was a certificate stolen, abused or newly issued? | Not described. The report calls the binaries legitimate and says the vendors were not shown to be compromised. | Any certificate theft, revocation, or how the attacker obtained the files. |
| How fresh were the signed files? | Signed 29 August 2026 (OpenAI file) and 27 August (Anthropic file). The ZIPs were posted 30 and 31 August. Gaps: about 1 day 17 h and 4 days 5 h (derived). | Whether the files were public builds. That they were recent is an inference from the dates. |
| Did the vendors respond? | No statement from OpenAI, Anthropic or GitHub appears in the three sources read. | Whether files were revoked, repositories removed or the apps changed. |
The signer panels are the useful part for a defender. An allow list that says "anything signed by this publisher may run" would have admitted Setup.exe. A control that also asks where the file runs from, and what it loads, would not have admitted a Setup.exe in a folder holding an unexpected winmm.dll. That second control is this briefing's recommendation, not a finding of the report.
Names that did the work of a control in the Yoba chain, as the report prints them. The right column is what each actually was.
| The label | What a reader assumes | What the report shows |
|---|---|---|
| GPT-5.6 Sol, GPT-6 Astra, Claude Opus | Desktop apps from the vendors | Model names used as app names by repositories Check Point calls fake. Anthropic's own download page lists Opus under Models; its desktop app is called Claude. |
| Setup.exe | An installer | A genuine signed executable whose metadata reads Codex and notification_helper.exe (Figure 7), kept only to load winmm.dll. |
| Signed file, valid signature | Safe to run | True of one file. It names the signer, not the package. |
| github.io and GitHub Releases | A trusted platform | Free hosting the operator set up, ranked by Google. No fake stars were needed. |
| WMProcess, WMPDMC.exe, wmpdui.dll | Windows Media Player | A folder under ProgramData that the dropper creates, with a copy of WMPDMC.exe from System32 that sideloads the loader. |
| Task author "Microsoft Corporation" | A Windows task | Set by the dropper, with the description "Collects device metadata for Windows Media Player.", running as Local System. |
| Telegram channel yoba_fanclub | A fan page | The channel whose profile picture seeds the generated domain name (the report's Figure 12 shows 1 subscriber). |
Stated and not stated, line by line
The table sets what Check Point and Help Net Security state against what neither states. "Not stated" means not found in the three sources, read in full. It does not mean the information does not exist.
What Check Point Research's report (27 October 2026), its blog post and Help Net Security (29 October 2026) state, and what they do not.
| The question | Stated | Not stated |
|---|---|---|
| Who found it, and for how long? | Check Point Research, tracking the campaign "over the past two months". | When the first victim was infected or how Check Point first saw it. |
| How many victims? | Nothing. | A count, countries, sectors, or any host infected with more than the miner. |
| How were victims lured? | Fake GitHub projects and github.io pages ranking on Google, "most likely" SEO poisoning. | Search adverts, social posts, email, or any other route. |
| Were vendors compromised? | No: research does not indicate it. Legitimate signed binaries abused. | How the signed files were obtained, and whether signing certificates were revoked. |
| Are the repositories still up? | Nothing. | Takedown status, or any contact with GitHub. |
| What was the payload? | XMRig 6.26.0 injected into svchost.exe, mining through Tor; a loader able to run any executable or PowerShell script. | Any other payload seen, mining revenue, or the wallet. |
| Who is behind it? | Indicators "suggest Russian origins"; works mostly in UTC-4; each repository uses a different email address and time zone. | Identity, group, or links to other campaigns. |
| Was there an earlier version? | A dropper in early June 2026 sideloaded by Cursor.exe, with the same Telegram channel and picture. | Whether Cursor.exe was a legitimate signed file (the report says that is unclear), or how it was distributed. |
| Did OpenAI or Anthropic comment? | Not in these sources. | Any statement, takedown request, or guidance to users. |
Note the cautions on dates. The scan listing's "first seen" times (3 September for sol-setup.zip, 14 September for Setup-Claude.zip, 23 September for a third item) show when a file was seen by a scanning service, not when anyone downloaded or ran it. Check Point's report is dated 27 October, 102 days 22 hours after the first repository (16 July 14:39 UTC) and 52 days 13 hours after the last release (4 September 23:14), both derived. The report does not say how long the pages were live.
The loader matters more than the miner
Check Point's own advice is that anyone who finds Yoba should treat it as a broader compromise and look beyond removing XMRig, because "YobaLoader is a generic loader" that accepts any Windows executable or PowerShell script the operator signs and sends. The miner is the payload Check Point saw. It says future waves "may deliver different malware families". That is a warning, not an observation of other payloads.
The checks come before the persistence. The dropper hashes the name of the program that loaded it and expects Setup.exe; if the name is wrong it does not stop, it sleeps in 200,000 loops of 5,500 milliseconds, which is about 12.73 days (derived: 1,100,000 seconds). That would outlast a sandbox that runs the DLL on its own for minutes (this site's reading). It then checks the keyboard layout. The check is a range test, 0x19 to 0x44, against a bitmask; decoding the printed mask sets 11 bits that match the 11 languages Check Point lists (Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek and Tatar), with Ukrainian (0x22) left out (derived). Last, it needs administrator rights; without them it shows a message and ends, and the user has to run it again elevated.
Persistence is deliberately dull. The dropper creates a folder called WMProcess under ProgramData, copies the real WMPDMC.exe from System32 into it, and drops the loader as wmpdui.dll beside it. A scheduled task runs the copy under Local System three minutes after startup, so a genuine Windows file loads the loader. The task's author reads Microsoft Corporation. A hunt for a bad file name may find little; a hunt for a Windows binary running from a folder it never lives in has more to find (this site's reading).
The loader then avoids a command server it could be blocked on. It reads the profile picture of a Telegram channel, uses the last 50 bytes as a seed to build a name of the form adjective, noun, verb and a number from 0 to 999 under dedyn[.]io, and asks Google's DNS over HTTPS service for a TXT record. The record is verified with a signature and decrypted to a Catbox file link. Using the three word lists in Check Point's published snippet (21 adjectives, 21 nouns, 18 verbs) the number of possible names is 21 x 21 x 18 x 1,000 = 7,938,000 (derived). Change the picture and the name changes, which is why blocking one domain is a weak control. In this site's reading, blocking the name pattern, or Telegram and DoH use that a managed machine has no business making, is a stronger control.
The miner runs inside svchost.exe, mines to an onion address through a local Tor proxy and Tor bridges, and pauses while the user is active. Check Point's configuration table says it resumes after 240 seconds idle. The consequence for monitoring is derived: a CPU alert that samples during working hours may miss it, because it mines when the machine is quiet. It uses a CPU thread hint of 85 per cent, so the spike is large when it does run.
Two links to earlier work on this site. A different campaign used a fake Claude installer reached through an advert, where the command a victim pasted was swapped: the ClickFix chain with a fake Claude installer. And a different report named nine AI products among an infostealer's targets without giving victim counts: Symantec's Aoki report. Neither is Yoba, and nothing in Check Point's report links them.
Where the genuine apps come from
The question a reader needs answered is where the real downloads are. Anthropic's own page, claude.com/download, read on 29 October 2026, lists a Claude desktop app for macOS, Windows and Windows on Arm, a Microsoft Store listing, a Linux beta, and enterprise deployment with MSIX installers on Windows and PKG installers on Mac. On that page the models Opus, Sonnet and Haiku appear as models, and the app is called Claude. Anthropic sells the app and has an interest in downloads coming from its own page.
OpenAI's pages could not be read for this briefing (openai.com and help.openai.com answered with block pages that were not bypassed, and no chatgpt.com page was requested). So the genuine OpenAI origin is not given here. A defender should take it from OpenAI's own page, in a browser, and write it down in the allow list rather than letting a search result decide. The Check Point screenshot shows the genuine openai.com result for GPT-6 Astra above the GitHub one for one query, which shows where a model page sits in search, not where a desktop app is distributed.
What to do, in order
Check Point's own advice is to download AI applications from vendor channels, to restrict unauthorised applications and administrator rights, and to inspect downloads and behaviour. Its blog post names its own products for the last of those. The list below puts the controls in the order that would have stopped this chain earliest. Items marked this site's reading are not from the report.
Take this with you
Ranked checklist for defenders
- Write down the genuine download origin of every AI desktop app your staff are allowed to use, from the vendor's own page (for Claude, claude.com/download), and tell staff new model names are not new apps.
- Make application control check the signer and the location together: a signed Setup.exe running from Downloads or an extracted ZIP in a user folder should not match a publisher rule (this site's reading).
- Block unsigned or unexpected DLLs from loading out of user writable folders, because the attack depends on a library placed beside a signed program (this site's reading of the sideloading step).
- Remove standing local administrator rights. The dropper stops without them, though a user shown its message can run it again elevated, so this raises the cost rather than ending it.
- Hunt for the persistence the report names: a folder WMProcess under ProgramData, WMPDMC.exe outside System32, wmpdui.dll, and a scheduled task authored Microsoft Corporation, described as collecting device metadata for Windows Media Player, running as Local System with a three minute boot delay.
- Hunt for the earlier variant's names too: a folder Microsaft Difendir under AppData and a Startup shortcut beginning msdefender_scheduler.
- Alert on endpoints that query dns.google for TXT records or fetch pages from t.me, and on names matching the pattern word, word, word, digits under dedyn.io (the pattern is derived from the report's format).
- Block the indicators as printed, and keep the list as a floor: the domain changes with the Telegram picture, and the report publishes a YARA rule for the dropper.
- Alert on sustained CPU use on idle machines, not only in working hours, on developer and finance endpoints first. The miner pauses while the user is active.
- Treat any confirmed host as a broader compromise: reimage, review what the host could reach, and rotate credentials it held (the rotation is this site's addition to Check Point's advice).
Technical details
These artifacts are as Check Point Research printed them on 27 October 2026, copied from the page read on 29 October. The report prints no hash type; the 40 character values are the length of SHA 1 (derived). Live infrastructure is defanged as the report defangs it. This site has not downloaded, opened or run any file named here. Not reproduced: the Ed25519 public key, the AES key and the XOR seed the report prints, the miner's pool password, the two bridge certificate strings, the three Outlook addresses and the DGA word lists with the full Python snippet. They are in the report, and a defender does not need them to hunt.
First, what is in the ZIPs. The report lists the file names with their ZIP entry times, and separately the compilation times that mark which files are the attacker's. The right column is re laid out from the report's table. Entry times are probably local time at UTC-4, which is how Check Point reads the actor's zone.
ZIP entry times (sol-setup.zip, then GPT-6-Astra-Setup.zip)
151.0.7922.174.manifest 2026-08-30 15:11:18 N/A
D3dx9_41.dll N/A 2021-10-18 17:58:06
owl-shell-runtime.json 2026-08-30 15:11:18 2026-08-30 15:11:18
Setup.exe 2026-08-30 15:11:18 2026-08-30 15:11:18
snapshot_blob.bin 2026-08-30 15:11:18 2026-08-30 15:11:18
v8_context_snapshot.bin 2026-08-30 15:11:18 2026-08-30 15:11:18
vk_swiftshader.dll 2026-08-30 15:11:18 2026-08-30 15:11:18
vk_swiftshader_icd.json 2026-08-30 15:11:18 2026-08-30 15:11:18
vulkan-1.dll 2026-08-30 15:11:18 2026-08-30 15:11:18
winmm.dll 2026-08-30 15:14:20 2026-08-30 15:14:20
Compilation timestamps (UTC)
D3dx9_41.dll 2076-06-18 21:48:40
Setup.exe 2026-08-19 20:00:27
vk_swiftshader.dll 2026-08-19 20:00:27
vulkan-1.dll 2026-08-19 20:00:27
winmm.dll 2026-08-30 19:14:19
Next, the dropper's behaviour and persistence settings. A defender can compare these with scheduled tasks and ProgramData on a suspect host. The hash values are of file names, so a different name changes them.
Expected host name check: DJB2 hash of the process base name equals 0xE6C2F326 (Setup.exe)
On a failed check: 200,000 iterations of Sleep(5500), about 12.73 days
Keyboard layout test: language ID in range 0x19 to 0x44, bitmask 0xEC0400C8401, exception 0x22 (Ukrainian)
Administrator check; if not elevated, message: Please run this program as Administrator.
Folder: ProgramData\WMProcess
Copied file: WMPDMC.exe (original taken from System32)
Dropped file: wmpdui.dll
Task author: Microsoft Corporation
Task description: Collects device metadata for Windows Media Player.
Task trigger: boot, delay PT3M (3 minutes after startup)
Task account: Local System (S-1-5-18)
Loader expects to run as WMPDMC.exe: hash 0x552751E3
Then the network chain: where the loader looks, how it builds a name, and how it deploys what it downloads.
Telegram channel: t[.]me/yoba_fanclub
User agent used: Mozilla/5.0 (Windows NT 10.0; Win64;)
Page element read: class tgme_page_photo_image (channel profile image)
Seed: last 50 bytes of the image
Generated name format: $adjective-$noun-$verb-$digit.dedyn[.]io (integer 0 to 999)
Lookup URL form: hxxps://dns[.]google/resolve?name=$DGA&type=TXT
Decrypted answer seen: 1hxxps://files.catbox[.]moe/z5zpy9.dat
Deployment method chosen by the first character (1, 2 or 3) of the decrypted answer. Listed by the report in this order: inject into svchost.exe; save as an .exe and run it; save as a .ps1 and run it
Executable path form: %TEMP%\$10_rand_char\$10_rand_char.exe (Zone.Identifier stream removed first)
Script path form: %TEMP%\$10_rand_char\$10_rand_char.ps1
PowerShell options: -WindowStyle Hidden -ExecutionPolicy Bypass -File
The miner's configuration, without the pool password and bridge certificates.
Payload: XMRig 6.26.0, injected into svchost.exe
Mining server: 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
TLS: Enabled (--tls)
Proxy: socks5://127.0.0[.]1:9550
Donation level: 0
CPU thread hint: 85%
User active pause: Resume after 240 seconds idle
Singleton mutex: Local\WindowsSecurity
Tor data directory: %TEMP%\torbundle\data
Also unpacked: Tor 0.4.9.12 and lyrebird 0.8.1; may load the WinRing0 driver service for MSR based mining optimisation
Tor bridges (obfs4): 51.89.231[.]85:24526 and 51.89.228[.]250:21668
The earlier variant, from early June 2026, and the table of process names the hashes decode to.
Earlier startup shortcut: msdefender_scheduler (a bracketed identifier follows in the report), in the Startup folder
Earlier copied host: %APPDATA%\Microsaft Difendir\msdtc.exe
Earlier sideloaded DLL: %APPDATA%\Microsaft Difendir\mswsock.dll
Earlier domain extension: .aber[.]ir (later: .dedyn[.]io)
Hash Process Product
0xE6C2F326 Setup.exe ChatGPT and Claude Opus
0x56221573 Cursor.exe Cursor AI Coding Agent
0x39DE0DD8 Unknown Unknown
Indicators of compromise as the report lists them. GitHub pages and accounts first, then hashes by role, then the infrastructure.
GitHub pages
github[.]com/gpt-5-6/sol-free-desktop
gpt-5-6.github[.]io
github[.]com/gpt-5-6/gpt-5-6.github.io
github[.]com/gpt-6-astra/gpt-6-astra.github.io
gpt-6-astra[.]github[.]io
opus-5-0[.]github[.]io
github[.]com/opus-5-0/opus-5-0.github[.]io
ZIP files
332e3b685e375aa44a5ec98511fc53be821df46a
c2b986704406d47dd88ee4e2fcffebc854ff2ce4
Signed OpenAI and Anthropic binaries
163c81187d8024123912c3c12d905fd5210afcb3
65a3ac8f341ae04982005fd2c4e83627a68793a3
YobaDropper
17e8639a00bb32b10cb9cf0d292e9441456ce4bb
20238b36645fc63139a76b19a480c6a9166472fa
4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586
60aece343959a2e1840f6aaeffa38b73ed21af2c
8777db31d8df78f36e4544a132d843dfb2a0f026
YobaLoader
22661f4bada8167fa0f410b75e53184998990abb
2ecb5548e9774a3d05e8669e8414dcc366929b79
3fef1af3664429e621d3e0f9408cb5102ef02b84
55043ea6d102670c014e2be5a8197e70b7c201cb
79e87a6df59d68b2dbd2c43950df5663d671007c
7dfcee02732ed89f1ddf25d1689863c26de3df15
bead5748d813a9828ddb7603a32e52aa15349768
cf90c4599257e76984a199d98b1fd082b820a54d
eeedc5c9007d7f01808285e0ae0c0b451bdba003
Telegram image
e7c0e981f81447892995d01ed986c0b462a6f0c5
Telegram channel
t[.]me/yoba_fanclub
DNS
dns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXT
In the wild URL
files.catbox[.]moe/z5zpy9.dat
Encrypted payload
7467b6980440ec27c4e0a8d940672c9f24e14216
Payload XMRig
ea16728f6928dc77deaddee74a6e736dd5f24fc5
XMRig endpoints
3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
51.89.228[.]250:21668
51.89.231[.]85:24526
The one detection rule the report publishes in full for the dropper. It matches a Windows executable (the bytes MZ at the start) that contains at least two of five byte patterns. The report also publishes a rule for the loader, which includes hard coded cryptographic constants and is not reproduced here.
rule yoba_dropper
{
meta:
author = "@Tera0017/Check Point Research"
description = "YobaDropper"
strings:
$code1 = {00 BB 40 0D 03 00 B9 7C 15 00 00 FF D6 31 C0}
$code2 = {BA 05 15 00 00 0F BE 08 84 C9 74 0A 6B D2 21}
$code3 = {53 B9 75 EE 40 70 48 83 EC 20}
$code4 = {BA 5C CD 17 E5 48 89 C1 E8 73 00 00 00}
$code5 = {0F C8 89 C0 4? 39 ?? 74 1? (49 0F AF C0| 48 69 C0 ?? ?? ?? ??) (4C 01 C8| 48 05 ?? ?? ?? ??) 49 89 C? 49 C1 E? 18 45 30 [2] 4? FF ?? EB}
condition:
uint16(0) == 0x5A4D and 2 of them
}
Finally, a hunting list this site derived from the report. It is not published by Check Point and is not a query for any one product.
DERIVED BY THIS SITE FROM THE REPORT. NOT PUBLISHED BY CHECK POINT.
1 Scheduled task where author is Microsoft Corporation AND description is
Collects device metadata for Windows Media Player. AND principal is S-1-5-18
AND boot trigger delay is PT3M AND the action path is under ProgramData\WMProcess.
2 Process image WMPDMC.exe running from any path other than System32 (or SysWOW64).
3 wmpdui.dll or winmm.dll loaded from a user writable folder or ProgramData by a
signed executable that is not in its normal install path.
4 Endpoint DNS over HTTPS to dns[.]google for TXT records, or requests to t[.]me,
from a machine that has no business doing either.
5 Hostnames of the form word-word-word-number under dedyn[.]io.
6 Named mutex Local\WindowsSecurity; a Tor process under %TEMP%\torbundle.
7 CPU above a threshold for a long period on an idle desktop, outside working hours.
The question your allow list has to answer
Everything the operator needed was already public or free: a model name that people were searching for, a GitHub page, two genuine signed files and one DLL compiled 85 seconds before it was posted. No certificate was stolen, according to everything in Check Point's published account. If a binary the vendor really signed can carry the attack, what does your allow list actually key on: the signer, the file, the folder it runs from, or the ZIP it came in?
Sources
- PrimaryReport 'Tricks from the Past deployed via signed ChatGPT and Claude binaries', 27 October 2026: the fake GitHub projects, the releases and dates, the signed binaries, the dropper and loader, the miner configuration, the indicators and YARA rules, and Figures 2, 5, 6 and 7. Read in fullCheck Point Researchaccessed 2026-10-29
- PrimaryBlog post 'Yoba Malware Targets ChatGPT & Claude Users With Fake AI Apps', 27 October 2026: the key findings, the statement that a valid signature covers one executable, the not compromised statement and the advice, with the company's own product names. Read in fullCheck Point Software Technologiesaccessed 2026-10-29
- PrimaryAnthropic's Download Claude page: the desktop app for macOS, Windows and Windows on Arm, the Microsoft Store listing, the Linux beta and enterprise MSIX and PKG deployment; the app is named Claude. Read 29 October 2026Anthropicaccessed 2026-10-29
- Reported byHelp Net Security article 'Yoba malware hides in fake desktop versions of ChatGPT and Claude', 29 October 2026: the lead, used as a pointer and for the quotation of Check Point's researcher. Read in fullHelp Net Securityaccessed 2026-10-29
