A new cybercrime campaign uses fake AI apps with real-sounding names to
infect people curious to try the newest tools

Date:
Thu, 29 Oct 2026 18:05:00 +0000

Description:
Experts warn ChatGPT and Claude are once again being spoofed to trick victims into installing a cryptocurrency miner.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers used SEO-poisoned GitHub pages and fake AI clients to lure victims into downloading malware The Yoba malware establishes persistence, evades analysis, and ultimately deploys XMRig cryptominers Campaign abuses interest in popular AI tools like GPT and Claude to monetize victims computing resources Cybercriminals are, once
again, exploiting peoples interest in AI tools to distribute cryptojackers
and make money - this time around, opting for a combination of spoofed
popular products, trusty old GitHub, and a little SEO poisoning.

The campaign was spotted by security experts from Check Point Research (CPR), whove been tracking it for the past two months, noting that the unnamed attackers created fake downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and hosted them on GitHub. Usually, when threat actors spoof legitimate software and try to disseminate it via GitHub, they go the extra mile to feign legitimacy - they artificially inflate download numbers, deploy bots to ramp up stars or forks numbers, and post fake comments. That way,
when a victim opens the page, they have no reason to doubt theyre looking at legitimate, popular software. Latest Videos From TechRadar Watch full video here:

In this case, however, they didnt bother with GitHub. However, CPR says that the pages still appear at the very top of Google s search engine results
pages for certain keywords, indicating that theyve invested heavily in SEO poisoning. SEO poisoning Search Engine Optimization (SEO) poisoning is a simple practice - criminals purchase hundreds (if not thousands) of articles, blogs, and social media posts on the dark web, and have them uploaded and published across the internet. You may like Hackers host fake ChatGPT model
on its official website but really it's just malware Experts warn this fake Claude install guide can be used to empty crypto wallets ChatGPT, Gemini, and Claude imitated in fake ads that steal credentials and MFA codes

Each post carries a link to the desired GitHub page, giving Google the signal that that specific page is popular and relevant for certain terms.

As a result, Google pushes it to the top of its results, unknowingly aiding the attackers into reaching their targets quicker. The attackers have also created separate GitHub websites to serve as descriptions for the
applications and linked them directly to downloadable installation files. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro
newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

As a practice, SEO poisoning was popular even before the advent of AI, but
now its gotten even easier, since the tools can easily generate as many articles as needed, for a fraction of the previous cost. Obviously, these texts are extremely low-quality, and Google has been working on labeling them as spam, but the process is still ongoing.

When victims land on these GitHub pages and download the executables, they think theyre getting a standalone client for an AI tool. What theyre getting instead is a piece of malware called Yoba.

Once a victim downloads and runs it, Yoba establishes persistence by creating a mechanism that would launch it automatically every time the system
restarts. Average computer users might have a tough time spotting it, too, since it presents itself as legitimate Windows software. What to read next Some Mac users think they're installing OpenAI Codex, but it's actually a malware that can steal passwords in seconds ChatGPT accounts linked to Asian scam banned by OpenAI Rogue AI agent engages 'Skynet mode' to search the internet for exposed LLMs to hijack and run malware attacks

Yoba then checks the device its running on to make sure its not in a sandbox, or infecting someone in a friendly country. It can deliberately delay execution for two weeks to make analysis more difficult, and checks the computers keyboard to avoid infecting systems from Russia, Belarus, Kazakhstan, and Uzbekistan. CPR did not say where the attackers are from, but this filter could give a strong indication. Deploying XMRig The malwares
final step is to contact the C2 server and pull the final payload. While this can be virtually anything - from infostealers to ransomware encryptors, CPR says it is currently being used to deploy XMRig.

XMRig is an entirely legitimate, open-source program used to mine the Monero cryptocurrency.

Unfortunately, it is extremely popular among cybercriminals because Monero is designed to be a privacy first coin and, unlike Bitcoin or Ethereum, cannot
be as easily tracked across the blockchain. Mining requires significant computing and electricity resources, as well as for the devices to be connected to the internet. By installing XMRig to countless devices, crooks can generate a hefty amount of tokens, leaving the victims to pick up the inflated energy and compute bill. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/a-new-cybercrime-campaign-uses-fake-ai- apps-with-real-sounding-names-to-infect-people-curious-to-try-the-newest-tools


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)