Fake AI Apps Use GitHub to Mine Crypto

How the attack worked

The Yoba campaign used fake GitHub projects to impersonate AI assistant applications, using names such as GPT-6 Astra, GPT-5.6 Sol, and Claude Opus to attract people searching for AI software. Rather than relying on phishing emails, the attackers used prominent search placement, likely through SEO poisoning, so victims found the fake download pages organically while looking for AI tools.

Each download package included a genuine, signed ChatGPT or Claude installer. When the real application launched, malware ran alongside it, making the installation appear completely legitimate to the victim. The observed final payload was XMRig cryptocurrency-mining software, although the loader used in the campaign could deliver other Windows or PowerShell payloads.

Why it succeeded

This campaign succeeded by combining several credibility signals that victims are trained to trust: strong search ranking, recognized AI brand names, and a legitimately signed installer. None of these signals, on their own, indicate malicious intent, which is exactly why combining them made the fake downloads convincing.

The campaign also used legitimate online services, including Telegram, Google DNS-over-HTTPS, and Catbox, to retrieve payloads, blending malicious infrastructure traffic with normal service usage.

What to watch for

• Software offered through a GitHub project page rather than the vendor's official download source
• AI application names suggesting unannounced or premium model releases, such as GPT-6 Astra or Claude Opus
• Installers that appear digitally signed and launch the expected legitimate application, but still install additional background processes
• Unexpected administrator privilege prompts during what should be a routine application installation

Building resistance

Organizations and individual employees can reduce exposure to campaigns like Yoba by treating software source as more important than search ranking or signed status alone. Key practices include:

• Downloading AI software only from the official vendor website or an organization-approved software portal, never from a search result or unofficial GitHub project
• Not assuming an installer is safe simply because it is digitally signed or because it launches a legitimate, recognizable application
• Restricting administrator privileges for software installation and reporting unexpected installation prompts to IT or security teams
• Inspecting downloads and application behavior for signs of unexpected background processes, even when the primary application appears to function normally

These steps address the core tactic in this campaign: making a malicious download look credible by pairing it with a trusted brand and a legitimate, signed binary.

How did the Yoba malware campaign trick victims into downloading it?

It used fake GitHub projects posing as AI application downloads with names like GPT-6 Astra and Claude Opus, relying on prominent search placement rather than phishing email to reach victims.

Why did the fake AI app installers seem trustworthy?

Each package included a genuine, signed ChatGPT or Claude installer, so the real application launched normally while malware ran alongside it.

What was the final payload in the Yoba campaign?

The observed final payload was XMRig cryptocurrency-mining software, though the loader could deliver other Windows or PowerShell payloads.

How can organizations protect against this type of attack?

Download AI software only from official vendor sites or approved portals, restrict unauthorized applications and administrator privileges, and inspect downloads and application behavior.