Cybercriminals have been using the hype surrounding artificial intelligence (AI) technologies to distribute cryptocurrency mining malware through fake desktop apps that mimic popular AI tools like ChatGPT and Claude.
In a recent report, cybersecurity vendor Check Point Research (CPR) said threat actors have been setting up fake GitHub repositories to advertise fake AI apps like GPT-5.6 Sol, GPT-6 Astra and Claude Opus, among others.
The hackers have even set up dedicated GitHub.io sites that promote their fake AI apps and trick victims into downloading malicious files.
According to the CPR researchers, the attackers are using search engine optimization (SEO) manipulation to get their malicious sites to rank high on Google.
How does the malware operate?
One of the most worrisome aspects of the campaign is how the attackers use legitimate software components from OpenAI and Anthropic to mask malicious activity.
The malicious ZIP archives that victims can download feature legitimate digitally signed executable files. These legitimate executables are bundled with malicious DLLs.
Once victims run the seemingly legitimate application, the malicious DLL gets loaded without their knowledge, thanks to the DLL sideloading technique.
This makes it very hard for victims to spot the attack since the malware relies on legitimate software to run its code.
At the end of the day, the attack leads to the installation of XMRig, a cryptocurrency miner that quietly uses the victims' resources to mine digital assets for the attackers.
Interestingly, the malware can also stop mining whenever it senses user activity so that it can evade detection.
Hackers employ various tactics to avoid detection
In addition, CPR researchers discovered that the malware includes several techniques to make security investigations harder.
For example, it can pause execution for a very long time if it senses that it is not running under the expected executable file.
It also checks the keyboard language setting on a computer before going ahead with the infection.
The first GitHub repository for the campaign showed up in July 2026, and malicious downloads started popping up at the end of August.
At the moment, the payload is a cryptocurrency miner, but researchers have warned that YobaLoader can potentially be used to deploy other types of malware.
