A new cybercrime campaign uses fake AI apps with real-sounding names to infect people curious to try the newest tools
- Attackers used SEO-poisoned GitHub pages and fake AI clients to lure victims into downloading malware
- The Yoba malware establishes persistence, evades analysis, and ultimately deploys XMRig cryptominers
- Campaign abuses interest in popular AI tools like GPT and Claude to monetize victims’ computing resources
Cybercriminals are, once again, exploiting people’s interest in AI tools to distribute cryptojackers and make money - this time around, opting for a combination of spoofed popular products, trusty old GitHub, and a little SEO poisoning.
The campaign was spotted by security experts from Check Point Research (CPR), who’ve been tracking it for the past two months, noting that the unnamed attackers created fake downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and hosted them on GitHub.
Usually, when threat actors spoof legitimate software and try to disseminate it via GitHub, they go the extra mile to feign legitimacy - they artificially inflate download numbers,...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
