Signed AI app campaign delivers Yoba malware and evades detection
Fake ChatGPT and Claude downloads are being used to distribute Yoba malware through legitimate, digitally signed applications paired with malicious libraries. The campaign uses trusted software and GitHub hosting to make the installers look credible, and it ends with a cryptocurrency miner running on compromised Windows computers. Signed installers mask Yoba’s delivery chain The attack does not require compromising OpenAI or Anthropic. Instead, criminals place malicious files beside authentic executables…