Tricks from the Past deployed via signed ChatGPT and Claude binaries
- Published by
- Check Point Research
- Published
- 27 Oct 2026
- Indicators
- 2 verified
The report
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude […]
Read the full analysis: Tricks from the Past deployed via signed ChatGPT and Claude binaries (Check Point Research).
Indicators
Malware C
- calm-piano-floats-313[.]dedyn[.]io
Mining Pool
- 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#28). This page is generated from that record and the report’s own title and summary; nothing is rewritten.