Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

Reported by Security Affairs (Pierluigi Paganini)

Summary by Cyber Security News30 Oct 2026, 22:22 CET

About this summary. This is a short excerpt from the description that Security Affairs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html

Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus.

Read the full article at Security Affairs →