Fake GPT-6 and Claude Opus Apps on GitHub Hid Malware Behind Real OpenAI and Anthropic Signed Installers

Someone built fake desktop apps called "GPT-6 Astra," "GPT-5.6 Sol" and "Claude Opus" and hid malware inside genuine installers signed by OpenAI and Anthropic. After all that stealth, the payload at the end was a cryptocurrency miner.

Check Point Research tracked the campaign, which it calls Yoba, for about two months. The fake projects live on GitHub, with GitHub.io pages describing the software and the malware served as ZIP files in GitHub releases. They have no fake stars or forks, yet they still show up among top Google results, most likely through SEO poisoning.

Neither OpenAI nor Anthropic was breached. The attackers simply abused their real, signed files.

A trusted signature as the disguise

The trick is old: DLL sideloading. Each ZIP contains a legitimate signed OpenAI Setup.exe, or in the Claude version a legitimate signed Claude executable, next to a malicious winmm.dll. When the real program starts, it loads the planted library. That DLL was compiled the same day it went into the archive, and all 180 of its exports are empty stubs.

Because the binaries already had very low detection rates, the operators did not even bother password protecting the ZIPs. The first repository appeared around July, the first two malicious releases at the end of August and a third about five days later. Each repo used a different Outlook address, and uploads came from different time zones, likely to blur who was behind them.

Built to wait out the sandbox

The loader is patient. If it is not running as Setup.exe, it sleeps 200,000 times for 5.5 seconds, roughly 12.73 days, long enough to outlast most automated analysis. It checks the keyboard layout and skips CIS countries, with an explicit exception for Ukrainian, and it asks the user to run it as Administrator.

Once in, it creates a WMProcess folder under ProgramData, copies in the real Windows Media Player WMPDMC.exe and drops a payload decrypted with the XOR seed "IRANNUMBERONE." A scheduled task dressed up as a Microsoft Corporation job that "collects device metadata for Windows Media Player" runs it as Local System three minutes after boot.

There is no dedicated command server. The malware leans on Telegram, Tor, Catbox and DNS over HTTPS. It downloads a Telegram channel's profile image and uses its last 50 bytes to generate the next domain from word lists.

All of that machinery delivers XMRig 6.26.0, injected into svchost.exe and mining through Tor to an onion endpoint. It pauses whenever it detects someone using the machine. Check Point says indicators point to Russian origins, with the actor operating mainly in UTC-4. It reported no victim counts.

Developers' trust in AI tooling keeps turning into an attack surface, as in the AGENTS.md Downloads folder hijack of Codex and Claude Code Cyberpresso covered earlier. Check Point's advice is to be wary of AI helpers installed from unverified repositories, however legitimate the signature on the installer looks.

Some offers on this page may be paid placements or contain affiliate links.