Counterfeit GitHub Repos Push Signed Loaders and Miners Under AI App Guise

Key points

• Fake GitHub repositories advertise unofficial desktop apps for well-known AI assistants and models such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus.
• Legitimately code-signed executables are used to slip past trust controls before dropping malicious loaders.
• The end goal observed so far is cryptocurrency mining on victim endpoints, not data theft.
• No CVE is involved, so patching will not help; detection depends on behavior and software-source policy.

A campaign tracked as Yoba is using GitHub as its storefront. The operators behind it publish repositories that look like download pages for desktop clients of popular AI assistants, borrowing the names of ChatGPT, Claude and model branding such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Nothing about those projects is genuine — the vendors themselves (OpenAI, Anthropic and GitHub) are being impersonated rather than compromised, and the repositories exist only to get a user to run an installer.

The people most exposed are those hunting for convenience: staff and students who want a native app instead of a browser tab, and who search for wrappers, tweaks or offline clients. Because the bait is a familiar product name, the usual caution about unknown downloads is often skipped. In a school environment, that risk lands on shared lab machines and district-issued laptops where a single install can affect many later users.

The delivery chain relies on signed executable abuse. Rather than shipping an obviously unsigned payload, the operators route execution through binaries carrying valid code-signing certificates, which lets the activity pass allowlisting and reputation checks that would otherwise stop an unknown file. Once running, the installer drops a loader that fetches additional components and ultimately deploys a cryptocurrency miner, consuming endpoint CPU and GPU capacity.

This is worth attention precisely because there is no vulnerability to patch. No CVE applies, and no vendor update will close the gap — the weakness being exploited is institutional trust in code signatures and in brand names. That shifts the defensive burden onto software sourcing rules, execution control and behavioral monitoring rather than vulnerability management.

Watch for new model names appearing as lures, since the campaign appears to track whatever is currently trending in AI news. Expect repository takedowns to be followed quickly by replacements under slightly altered names. The practical signal on an affected endpoint is unexplained resource consumption and outbound connections to mining infrastructure; the practical prevention is making sure unofficial AI desktop clients never reach execution in the first place.

What to do now

1. Enforce application allowlisting so installers launched from Downloads, Temp or other user-writable paths cannot execute, and alert on attempts.
2. Publish a clear rule that AI desktop clients are installed only from official vendor sites, never from third-party repositories or 'wrapper' projects.
3. Hunt for miner behavior now: sustained CPU/GPU saturation, connections to mining pool domains, and new scheduled tasks or autoruns on endpoints.
4. Review code-signing trust policy — log and alert on signed binaries whose publisher is unexpected for the software being installed, rather than treating any valid signature as safe.
5. Block or proxy-inspect archive and executable downloads from GitHub for standard users; permit repository access only where the business need is documented.
6. Check recently installed software on lab and shared devices for unrecognized AI-branded applications and remove them with a full scan.
7. Report counterfeit repositories to GitHub and add confirmed malicious hashes and domains to blocklists for endpoint and network controls.

Original source

The Hacker News