Check Point Research identified a real campaign, tracked as Yoba, that uses fake GitHub projects and websites posing as new ChatGPT and Claude desktop applications. Victims searching for AI tools can be directed to convincing pages for supposed releases such as GPT-6 Astra and Claude Opus, then download malicious ZIP files hosted through GitHub releases. The downloaded files misuse legitimate signed software to help install malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Google’s top result says, ‘Download GPT-6 Astra Setup.’ Tempting? That result can lead to a fake GitHub.io page, then a GitHub release ZIP. Inside: a real signed Setup.exe beside a malicious DLL. That’s the trick: the signed installer isn’t the whole download. If it says ‘Please run this program as Administrator,’ don’t give it the keys. A top Google result isn’t approval. Get AI apps only from the vendor’s official site or our approved software catalog.
A real malware campaign called Yoba used fake GitHub projects advertising supposed ChatGPT and Claude desktop applications. Victims were lured by high-ranking Google results and download buttons, then ran ZIP-packaged installers that appeared legitimate but gave attackers control of the device. The…
Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
CERT-UA reported a real phishing campaign where victims receive an email with an image attachment that leads (via a shortened link) to a ZIP download. The ZIP contains a script disguised as a PDF, which installs a malicious Notepad++ plugin and sets up an automated task that repeatedly runs malware…
North Korea-linked Lazarus targeted South Korean organizations with tailored phishing emails that directed recipients to fake portfolio and résumé websites. The sites, including GitHub Pages hosting a purported senior network-appliance developer résumé, abused vulnerable financial-security software…
