Fake ‘GPT-6’ and Claude Apps Hide a Miner Behind Real Signed Installers
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.