Fake AI Apps Deploy Crypto Miners via Signed Executables

Introduction

Threat actors have launched a campaign that disguises malicious cryptocurrency miners as legitimate AI desktop applications. The operation, tracked as Yoba, leverages fake GitHub repositories claiming to offer desktop versions of popular AI tools such as ChatGPT and Claude. Rather than delivering genuine functionality, these loaders deploy a malware family designed to mine cryptocurrency on compromised systems.

The Yoba Campaign and Its Deceptive Payloads

The campaign creates convincing GitHub projects with names like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, aiming to attract users seeking unofficial desktop clients for AI services. These repositories host loaders that appear benign but secretly install cryptocurrency mining software. Researchers note that the malware is delivered through executables that carry valid code signatures, lending an air of legitimacy to the malicious binaries. This use of signed executables helps the payloads bypass basic security checks and gain initial execution on target machines.

Why Signed Executables Are Central to the Attack

Code signing is typically used to verify software authenticity, but threat actors exploit this trust by obtaining or stealing valid certificates. In the Yoba campaign, signed executables allow the malware to evade detection by security solutions that rely on signature-based filtering. The signed binaries may also bypass application control policies in enterprise environments, making the attack particularly dangerous for organizations that do not enforce strict certificate validation or monitor for anomalous signed code.

Who Is at Risk

Individuals searching for unofficial AI desktop applications are the primary targets. However, enterprise users may also be exposed if employees download and execute these fake tools on company devices. Organizations that permit unsigned or unverified software installations, or those lacking robust endpoint detection and response capabilities, face elevated risk from this campaign. The use of signed executables increases the likelihood that the malware will persist undetected, potentially leading to resource theft and degraded system performance.

Mitigation Strategies for Security Teams

Defenders should block execution of binaries from untrusted GitHub repositories by default. Security teams must inspect code signing certificates associated with downloaded executables and revoke trust for any certificates linked to known malicious activity. Endpoint detection and response tools should flag processes that spawn cryptocurrency miners or exhibit unusual CPU usage patterns. Additionally, network monitoring can identify outbound connections to mining pools, which often serve as indicators of compromise. Educating users about the risks of downloading unofficial software remains a critical layer of defense.

Conclusion

The Yoba campaign highlights the evolving tactics used to deliver cryptocurrency miners through deceptive AI-themed applications. By combining fake GitHub projects with signed executables, threat actors increase their chances of bypassing traditional defenses. Security professionals must remain vigilant in verifying software integrity and monitoring for suspicious execution patterns. At Grivyonx Technologies, our AI automation and cloud security services help organizations detect and respond to threats like these through intelligent threat hunting and proactive endpoint protection.