Fake ChatGPT and Claude Installers Load Malware Through Signed Apps

Fake GitHub projects offering ChatGPT and Claude desktop installers put a malicious winmm.dll beside real signed application binaries. Check Point Research traced the DLL sideload into YobaDropper, which copies WMPDMC.exe to C:\ProgramData\WMProcess, adds wmpdui.dll and creates a boot-triggered task running as Local System after a PT3M delay. The second-stage loader uses a Telegram profile image and Google’s DNS-over-HTTPS resolver dns.google to locate another payload. Check Point observed an XMRig miner; the loader can accept different payloads.

On managed Windows endpoints, review downloads from the reported fake AI-app GitHub releases and inspect archives and execution history for the Setup.exe/winmm.dll pairing. Hunt current scheduled tasks and, where creation events were collected, Windows Security event 4698 for C:\ProgramData\WMProcess\WMPDMC.exe; task XML carries the action and principal. Isolate hosts where the sideload or task ran, preserve the files, and replace the unauthorized install with a vetted vendor-channel package. Verify the task and neighboring DLL are gone and the approved installer came from your app catalog. A valid signature on Setup.exe is compatible with this attack, and missing network history calls for a live task and file check.