Fake ChatGPT and Claude desktop applications are being distributed through GitHub, packaging malware alongside genuine executables signed by OpenAI and Anthropic, according to research by Check Point, which calls the campaign Yoba. Check Point describes fake GitHub projects offering supposed “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus” desktop apps, with attackers bundling malware with genuine signed executables without compromising OpenAI or Anthropic. The attackers promoted the fake apps through GitHub project pages, including GitHub.io, that described their features and linked to ZIP downloads hosted on GitHub releases; some of these pages appeared among the top Google results. Check Point found no signs of artificially inflated GitHub stars or forks but said the wording and search visibility suggested the attackers had optimised the pages to attract users through Google. Running the package launches a genuine, signed application executable, beside which attackers placed a malicious file called winmm.dll that the application loads through DLL sideloading. The malicious DLL, named YobaDropper by researchers, checks its execution environment, displays a message requesting elevated access and exits without administrator privileges, and excludes several keyboard languages, including Russian and Belarusian, while Ukrainian remains eligible. After installation, a scheduled task launches a copied Windows executable three minutes after startup, loading YobaLoader so the infection survives a restart.