Threat actors are distributing loaders and cryptocurrency miners disguised as desktop clients for Anthropic's Claude and OpenAI's ChatGPT, in a campaign security researchers have dubbed Yoba, according to The Hacker News.
The operation centres on fake GitHub repositories that advertise native desktop applications for models including "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus." Visitors who download the installers receive a signed executable that delivers the campaign's malware payload rather than a working AI client.
The pitch is convincing precisely because it is plausible. Neither OpenAI nor Anthropic currently offers an official downloadable desktop client of the kind these repositories describe, yet the expectation that one should exist is entirely reasonable. That gap between expectation and reality is the seam the campaign exploits — a user looking for a native app finds a polished project page, complete with stars, a detailed README, and release binaries, and concludes they have found the official distribution.
Signature validity compounds the illusion. The executables carry valid digital signatures, which many users and even some verification routines treat as shorthand for vendor legitimacy. In this case the signature attests only that the binary was signed by someone holding a valid certificate — borrowed trust, not proof that the software came from OpenAI or Anthropic. Signature checks belong inside a wider verification routine: confirm the certificate subject, trace the download back to the vendor's genuine domain, and treat a green checkmark as one input among several.
Repository popularity is similarly weak signal. Stars and polished documentation are cheap to manufacture. The more informative checks are the ones that are harder to fake — commit history, contributor identities, account age, and whether the project links to an official organisation page that recognises it.
For IT and security teams provisioning AI tooling across endpoints, the campaign offers a practical checklist. Before installing any purported ChatGPT or Claude client:
- Verify that the download originates from the vendor's own domain or an explicitly official channel.
- Read the signing certificate subject rather than merely noting that a signature is present.
- Cross-check any model names against the vendor's public announcements — unexplained versions such as "GPT-5.6 Sol" are a warning sign.
- Treat repository polish — stars, README quality, release binaries — as presentation, not provenance.
If a suspicious installer has already reached a machine, the response sequence is familiar: isolate the host from the network, rotate credentials that were accessible on it, and hunt for persistence mechanisms before returning the system to service. Cryptojacking payloads are rarely the only thing a loader drops.
The Yoba campaign is part of a broader pattern in which threat actors wrap malware in the branding of fast-moving technology trends — from fake AI websites to cloned browser extensions impersonating popular tools. As enterprise demand for AI clients outpaces the vendors' own distribution options, that pattern is likely to persist. The lesson for IT teams is that legitimacy signals — signatures, stars, polish — describe how a package presents itself, not where it came from.
據 The Hacker News 報導，威脅行為者正以 Anthropic Claude 與 OpenAI ChatGPT 桌面客戶端的名義散布載入器（loader）與加密貨幣挖礦程式，這項行動被安全研究人員命名為 Yoba。
行動的核心是一批偽造的 GitHub repo，聲稱提供涵蓋「GPT-5.6 Sol」、「GPT-6 Astra」及「Claude Opus」等模型的原生桌面應用程式。下載安裝程式的訪客取得的是一支已簽名的可執行檔，其投放的是該行動的惡意軟件 payload，而非可用的 AI 客戶端。
說法之所以可信，正因為它聽來合理。OpenAI 與 Anthropic 目前均未提供這類 repo 所描述的官方可下載桌面客戶端，然而用戶期望此類產品應該存在，實屬正常。期望與現實之間的落差，正是這項行動所利用的縫隙——尋找原生應用的用戶看到一個製作精良的專案頁面，星標齊備、README 詳盡、release binary 完整，遂認為自己找到了官方發佈渠道。
數碼簽名有效性令幻象更為牢固。這些可執行檔附有有效的數碼簽名，不少用戶甚至部分驗證程序，均視之為廠商正規產品的指標。在此個案中，簽名僅能證明該二進位檔由持有有效 certificate 的人士簽署——那是借來的信任，並不能證明軟件來自 OpenAI 或 Anthropic。簽名檢查應納入更全面的驗證程序之內：確認 certificate 的 subject、追溯下載來源至廠商真正的域名，並將綠色剔號視為多項輸入之一。
Repo 熱門程度同樣是薄弱的指標。星標及精美文件的製作成本極低。較具參考價值的檢查項目，恰恰是較難偽造的——commit 歷史、contributor 身份、賬戶年齡，以及該專案是否連結至認可它的官方 organisation 頁面。
對於需在各端點部署 AI 工具的 IT 及保安團隊，這項行動提供了一份實用清單。在安裝任何聲稱是 ChatGPT 或 Claude 客戶端之前：
- 核實下載是否源自廠商自身域名或明確的官方渠道。
- 閱讀簽名 certificate 的 subject，而非僅確認簽名存在。
- 將任何模型名稱與廠商的公開公告互相核對——「GPT-5.6 Sol」等來歷不明的版本是警號。
- 將 repo 的精美程度——星標、README 文件質量、release binary——視為包裝，而非來源證明。
若可疑安裝程式已進入電腦，應對流程並無新意：將主機從網絡隔離、輪換在其上可讀取的憑證，並在系統恢復服務前搜尋持久化機制。加密貨幣劫持 payload 很少是 loader 釋放的唯一內容。
Yoba 行動是一個更廣泛模式的一部分——黑客以熱門科技趨勢的品牌包裝惡意軟件，從假冒 AI 網站到抄襲知名工具的偽冒瀏覽器擴充功能，不一而足。隨著企業對 AI 客戶端的需求超越廠商自身的發佈渠道，此模式很可能持續。給 IT 團隊的教訓是：合法性信號——簽名、星標、精美包裝——描述的是套件如何自我呈現，而非它的真正來源。