Check Point: Fake ChatGPT and Claude Apps Deliver XMRig Crypto Miner
- —Attackers use SEO manipulation to rank malicious sites high on Google
- —XMRig miner hides inside legitimate signed OpenAI and Anthropic files
- —The first GitHub repository appeared in July 2026, with downloads starting in late August
- —The YobaLoader payload could be repurposed to deliver other malware
Why it matters: The campaign exploits trust in GitHub and the OpenAI and Anthropic brands to infect crypto and AI users with a miner that is hard to detect without load monitoring.
Source: U.Today