Plan
active
Fake ChatGPT/Claude GitHub Apps Drop Crypto Miners via Signed Loaders
- Engineer — Plan: Developers are a likely target audience for fake AI desktop tools distributed via GitHub. Audit endpoints for unauthorized process execution tied to AI app installs and enforce a policy requiring official sources (openai.com, anthropic.com) for any AI desktop clients used internally.
- SOC/IR — Plan: The Yoba campaign uses signed loaders to slip past initial defenses before dropping miners — worth building detections for unexpected signed-binary child processes spawning mining activity. No specific IOCs are provided in this summary, so a targeted sweep isn’t actionable yet; queue a detection rule for anomalous CPU-spike processes spawned by newly installed apps.
- Leader — Learn: This campaign exploits employee enthusiasm for AI tools to sneak malware in via unofficial downloads — a useful data point for refreshing acceptable-use policy around AI desktop applications and reinforcing approved software procurement channels.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.