Fake ChatGPT and Claude Apps Can Install Crypto Miners on Windows PCs

Free desktop apps promising access to new AI models can be tempting, but a recent campaign shows why their download source matters. Fake apps advertised as ChatGPT or Claude tools have been used to install malware on Windows computers. The reported campaign, called Yoba, used fake GitHub projects and web pages to make the downloads appear credible.

The ZIP files included a legitimate, digitally signed setup program alongside a malicious DLL. When the setup program ran, it loaded that DLL, allowing the malware to start through a technique known as DLL sideloading. Researchers found that the malware could wait for about 12 days before continuing, then use a scheduled task to persist across restarts.

A later stage of the infection retrieved instructions and downloaded a payload that ran an XMRig cryptocurrency miner inside a Windows system process. Mining can consume processor resources and electricity, slowing a computer. The report did not give a victim count, and it does not establish that Indian users were affected. Still, the lure of a free AI desktop app could reach users anywhere.

Download AI software from the vendor’s official website or a trusted app store, and check that the vendor actually offers the app before installing it. A valid signature on one file does not guarantee that every file in the download is safe. If you installed a suspicious app, disconnect the device from sensitive accounts and run a full scan with updated security software. Businesses can also reduce exposure by limiting software installations to approved apps.

NPAV Total Security provides comprehensive protection against viruses and malware, including real-time detection and protection against malicious files. It adds an essential layer of security to personal PCs, complementing safe browsing and responsible downloading habits.