A signed installer from OpenAI is not the same thing as a safe download

Check Point Research published its findings on 27 October about a campaign it calls Yoba. The bait is a desktop app for an AI assistant that does not exist: GPT-5.6 Sol, GPT-6 Astra, Claude Opus. Each one has a GitHub project, a tidy GitHub Pages site describing it, and a download button. No inflated stars, no fake forks. People find them because the pages were tuned to rank well in search, and a GitHub link looks like a safe place to land.

The trick inside is old and still works. Every ZIP holds a real, correctly signed Setup.exe from OpenAI or Anthropic, sitting beside a file named winmm.dll that came from neither. Windows loads that DLL out of the folder next to the program, so the genuine installer runs the attacker's code on its way past. The signature on the executable checks out perfectly. It simply does not vouch for the rest of the folder, or as Check Point phrased it, a signature "verifies the signer and integrity of an individual executable, not every component distributed with it".

What lands is XMRig 6.26.0, a cryptocurrency miner pointed at a Tor address and kept alive by a scheduled task. Day to day that shows up as a laptop running hot, loud and slow for no obvious reason. Neither OpenAI nor Anthropic was breached here; the attackers just repackaged files anyone can download.

The defence is dull and effective: get AI software from the vendor's own site, typed into the address bar rather than reached through a search result, and treat a GitHub release as an upload by a stranger rather than a recommendation. Tendvane's Safety check lists installed programs and the things set to start with Windows, flagging entries that look unwanted, which is usually how something sitting under a name you half-recognise gets noticed. It points them out rather than removing them, but noticing is the part most people never get to.