A work laptop is where an unapproved AI app ends up. Photo: Norbert Levajsics, CC0, via Wikimedia Commons
When a new AI model is announced, someone on your team will search for the app and try to install it. That habit is now being used against businesses. On 27 October 2026, Check Point Research published an analysis of a campaign it calls Yoba, in which fake "desktop apps" for ChatGPT and Claude hosted on GitHub deliver malware. The Hacker News reported on it on 29 October 2026.
The short answer
The attackers created GitHub projects named after AI products, including GPT-5.6 Sol, GPT-6 Astra and Claude Opus, with web pages describing the software. The downloadable ZIP files contain a real, signed program from OpenAI or Anthropic plus a malicious file next to it. Windows loads the malicious file when the signed program starts, a technique known as DLL sideloading. In the cases Check Point observed, the result was a hidden cryptocurrency miner. The fix for a business is a policy, not a product: install AI apps only from the vendor's own download page.
How the lure works
According to Check Point, the lure has four parts:
- A believable name. Projects are named after hot new models, such as "GPT-6 Astra". Because new model names appear all the time, staff cannot easily tell a real product from an invented one.
- Real infrastructure. The projects use GitHub repositories and GitHub Pages, so the address ends in a trusted domain. Check Point found no fake stars or forks, so the projects do not look popular on GitHub itself.
- Search results. The projects appear among top Google results. Check Point says this is most likely SEO poisoning, where attackers optimise titles and descriptions so that their pages rank.
- A signed program. The ZIP includes a legitimately signed OpenAI or Anthropic executable, which can make a quick check look reassuring, while the harmful file travels alongside it.
Check Point also notes that the ZIP files on GitHub were not password-protected, because the malicious files already had low detection rates.
What happens after the install
We will not walk through the technical chain here, but the business-relevant points from Check Point's report are these:
- The first-stage file shows a message asking the user to run it as an administrator, and stops if they do not. A genuine chat app should not need that to open.
- It sets up a scheduled task so it runs again after restart, and the task is labelled to look like a Windows component.
- It then downloads a further file using ordinary services, which is meant to make the traffic look like normal activity.
- In the cases observed, the final payload was an XMRig cryptocurrency miner. Check Point states that the loader is generic and the operator could send any program or script, so a later wave might deliver something worse.
A miner uses your computers' processing power and electricity for someone else's profit, and it slows the machine. The larger concern is that the same foothold could be used for other purposes.
Why this matters to a small business
Most small companies do not have an application allow-list. People install tools they hear about in news and social posts. AI tools are the current example, because new model names arrive constantly and staff want to try them. A fake page that matches a model name people have just read about is an easy fit for that behaviour.
It also matters that these are desktop apps. A web chat in a browser does not install anything on your computer. Our guide to practical AI uses for small business covers the use cases, and most can run in a browser without installing anything. If you are building AI into your own workflow, our AI automation service page explains how we approach it safely.
A simple AI-app policy
You can put this on one page.
- Use the vendor's own site. Anthropic's download page is at claude.com/download and OpenAI's is at chatgpt.com/download. Go there by typing the address or using a saved bookmark, not through a search result.
- Be wary of model names. If a repository advertises a model name you have not seen from the vendor, treat it as a lure.
- Approve before installing. One person owns the approved software list.
- Do not run unknown installers as administrator. A prompt to do so for a chat app is a warning sign.
- Prefer the browser version when you only need to chat.
How to tell a real download page from a fake one
You cannot judge a download by how it looks, so use a short routine that does not depend on spotting tricks:
- Start from the vendor, not from a search. Open the vendor's own site, find the download link there and use that. Both Anthropic and OpenAI publish desktop downloads on their own domains, so there is no reason to fetch the app from a third-party repository.
- Check the address character by character. A GitHub Pages address such as a project name followed by github.io is a personal page that anyone can create. It is not the vendor's website.
- Be careful with "free" and "unlocked" claims. One of the fake projects Check Point lists is named as a free desktop version. Offers of a paid model for nothing are a classic lure.
- Ask before installing on a work computer. A one-line message to whoever manages IT costs a minute and removes the guesswork.
For a small team, the most reliable control is to make installing software an approval step rather than an individual choice. If you have no IT staff, the person who owns the company's Microsoft or Google accounts can fill the role. Tell staff that asking is expected, and that nobody will be criticised for it.
Common mistakes
- Trusting a signed file. A valid signature on one file in a ZIP does not make the other files safe.
- Trusting the GitHub address. Anyone can create a repository and a GitHub Pages site.
- Trusting search ranking. Check Point reports these projects ranked well on Google.
- Dealing with it only once. If someone has already installed one of these apps, treat that computer as compromised, as the loader can bring in other software.
What to do if someone already installed one
- Ask staff whether anyone has downloaded a desktop app for a new AI model from GitHub
- Take any affected computer off the network and have your IT provider investigate it
- Look for unexpected scheduled tasks and unusually high processor use
- Change passwords and sign out sessions on accounts used from that computer
- Review Check Point's published indicators with your IT provider or security vendor
- Write down the approved software list and who maintains it
Key takeaways
- Fake AI desktop apps are being distributed through GitHub projects that rank in search results.
- A signed file inside a download does not mean the whole package is safe.
- Get ChatGPT and Claude only from the vendors' own download pages, or use the browser version.
- Be suspicious of any chat app that demands administrator rights.
- A short software-approval policy removes most of the risk at little cost.
For wider security routines, see our website maintenance guide, which covers updates and access control for your public site.
Sources
- Check Point Research, "Tricks from the Past deployed via signed ChatGPT and Claude binaries", 27 October 2026: https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
- The Hacker News, "Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners", 29 October 2026: https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
- Anthropic, Download Claude: https://claude.com/download
- OpenAI, Download ChatGPT: https://chatgpt.com/download/
