OTX Threat: Tricks from the Past deployed via signed ChatGPT and Claude binaries

Check Point Research discovered a campaign tracked as Yoba that exploits the popularity of AI tools like ChatGPT and Claude. Attackers created fake GitHub projects mimicking desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers alongside legitimate, signed executables from OpenAI and Anthropic, employing DLL sideloading techniques to bypas