OpenAI e Anthropic · Exploitation confirmed

Fake ChatGPT and Claude Apps on GitHub Install XMRig Miner

Oct 29, 2026 · 1 min read

A campaign dubbed Yoba distributes fake ChatGPT and Claude desktop apps on GitHub, with projects like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. According to The Hacker News, the packages abuse signed OpenAI and Anthropic executables to sideload YobaLoader, which deploys the XMRig miner and retrieves payloads via Telegram and DNS-over-HTTPS. Download AI clients only from official sources.

By HIFY Radar newsroom Updated 10/29/2026 12:53 PM Get this every day →← Back to the feed 2 sources

HighSupply chainExploitation confirmedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Cybercriminals are posting fake ChatGPT and Claude desktop apps on GitHub, with names like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Once installed, the packages use signed OpenAI and Anthropic executables to load malware that mines cryptocurrency. The campaign has been dubbed Yoba.

Why it matters

Employees who download these fake clients install the XMRig miner, which consumes processing power and energy, degrades machine performance, and raises costs. The signed executables and well-known brands make the packages look legitimate and increase the risk of internal installs.

What to do

Require that ChatGPT and Claude clients be installed only from OpenAI and Anthropic official sources. Check whether anyone downloaded projects like GPT-5.6 Sol, GPT-6 Astra, or Claude Opus from GitHub and monitor abnormal CPU usage.

For the technical team

Affected: OpenAI e Anthropic (marcas falsificadas) Aplicativos desktop falsos de ChatGPT e Claude distribuídos no GitHub (campanha Yoba: projetos como GPT-5.6 Sol, GPT-6 Astra e Claude Opus) · Users who install the fake GitHub packages; no real OpenAI or Anthropic product or version is cited as vulnerable. Fake projects: GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.
Exploitation: Active campaign reported by The Hacker News; follow-up analysis dubbed the campaign Yoba and detailed the sideloading via signed executables.
Fix: Sources cite no fix. Mitigation: remove the fake apps, install clients only from OpenAI and Anthropic official sources, and monitor abnormal CPU usage.
Vector: Fake GitHub repositories offer ChatGPT and Claude desktop apps; the installers use legitimate signed OpenAI and Anthropic executables to sideload YobaLoader, which deploys the XMRig miner. Payloads are retrieved via Telegram and DNS-over-HTTPS. Requires the user to download and run the fake app.
More details: Campaign dubbed Yoba; the first report described fake apps delivering YobaLoader and XMRig, and the new analysis detailed the fake projects and abuse of signed executables. Report and analysis published by The Hacker News.

Timeline

10/29/2026 12:53 PM
New analysis dubs the campaign 'Yoba' and details that the fake projects, like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, abuse signed executables to install the miners.
10/29/2026 12:42 PM
First report of the fake GitHub app campaign sideloading YobaLoader and XMRig.