Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
MALWAREAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers created fake AI desktop apps on GitHub that looked like ChatGPT and Claude. The downloads contained a legitimate signed program alongside a malicious file, and when run they quietly installed software that uses the victim's computer to mine cryptocurrency.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Only download AI tools from official vendor sites rather than GitHub repositories or search-result links.
- Check endpoints for a WMProcess folder under ProgramData, a copy of WMPDMC.exe, or a wmpdui.dll file.
- Review scheduled tasks for entries authored as Microsoft Corporation that launch WMPDMC.exe three minutes after boot.
- Investigate any unexpected Tor activity or sustained high CPU usage that could indicate cryptocurrency mining.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Security Affairs