Tricks from the Past deployed via signed ChatGPT and Claude binaries

Check Point Research has uncovered a sophisticated cyberattack campaign that leverages the popularity of AI tools like ChatGPT and Claude to spread custom malware. The attackers create fake GitHub projects impersonating legitimate AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, using SEO poisoning techniques to make these malicious projects appear in top search results.

The malware, dubbed Yoba, is delivered through malicious installers that contain a dropper component. This dropper uses a technique called DLL sideloading, placing malicious code next to legitimate, signed executables from OpenAI and Anthropic to bypass security protections. The campaign demonstrates strong operational security by avoiding dedicated command-and-control infrastructure and instead using platforms like Telegram, Tor, Catbox, and DNS over HTTPS (DoH).

GitHub Deception

The attack begins with malicious GitHub repositories that impersonate ChatGPT and Claude-related models. These repositories use GitHub.io pages to describe the software's capabilities while hosting the actual malware as a release. The phishing landing pages contain download links pointing directly to malicious ZIP releases hosted on GitHub.

Despite showing no signs of fake engagement like artificially inflated stars or forks, these repositories still appear among top Google search results, likely due to SEO poisoning where attackers optimize titles, descriptions and domains to rank highly. Each repository uses different email addresses and operates in various timezones (UTC+4, UTC-4, UTC+3), suggesting an attempt to obscure the threat actor's true location.

Malicious Delivery System

The malicious ZIP files contain a legitimate signed executable (Setup.exe from OpenAI or Anthropic) and a malicious DLL (winmm.dll). The DLL contains multiple export names but most have been stripped of code, leaving only empty functions. The malware performs several anti-analysis checks before deploying its payload, including verifying it's running as Setup.exe, checking if the victim is in a CIS country (excluding Ukraine), and ensuring administrator privileges.

The dropper contains multiple XOR-encrypted strings that are decrypted when needed, including file paths where embedded binaries are dropped. The campaign shows indicators suggesting Russian origins and appears to operate primarily in the UTC-4 time zone, though the inconsistent timezones across repositories suggest deliberate obfuscation.