Fake desktop applications claiming to be ChatGPT or Claude are spreading cryptocurrency-mining malware through Google search results and fake GitHub pages. Security researchers at Check Point Research tracked the campaign after finding repositories that ranked highly in search. The download packages contain a genuine, digitally signed installer from OpenAI or Anthropic alongside a malicious file named winmm.dll. When the installer runs, Windows loads the malicious library through DLL sideloading. The malware requests administrator rights, hides itself in system directories, and receives commands via a Telegram channel profile picture and Google DNS records. The observed payload is a cryptominer, though the loader could deliver other malware. Systems with certain keyboard layouts are filtered out. Experts advise downloading AI applications only from official developer sites or the Microsoft Store, noting that a valid digital signature alone no longer guarantees safety.
Fake desktop applications claiming to be ChatGPT or Claude are spreading cryptocurrency-mining malware through Google search results and fake GitHub pages. Security researchers at Check Point Research tracked the campaign after finding repositories that ranked highly in search. The download packages contain a genuine, digitally signed installer from OpenAI or Anthropic alongside a malicious file named winmm.dll. When the installer runs, Windows loads the malicious library through DLL sideloading. The malware requests administrator rights, hides itself in system directories, and receives commands via a Telegram channel profile picture and Google DNS records. The observed payload is a cryptominer, though the loader could deliver other malware. Systems with certain keyboard layouts are filtered out. Experts advise downloading AI applications only from official developer sites or the Microsoft Store, noting that a valid digital signature alone no longer guarantees safety.