Fake ChatGPT and Claude desktop apps on GitHub use DLL sideloading to deploy YobaLoader, which retrieves and executes an XMRig miner.
A newly disclosed malware campaign dubbed Yoba distributes fake ChatGPT and Claude desktop installers through GitHub.