Fake ChatGPT Apps Are Mining Crypto on Your PC

Michael Miller · 2026-10-29

You've probably seen those GitHub projects promising a sneak peek at GPT-5.6 Sol or Claude Opus. They look legit—signed executables, polished READMEs, the whole nine yards. But here's the kicker: they're not AI tools. They're crypto miners, and they're after your CPU. Security researchers have dubbed this campaign "Yoba." The playbook is simple: create fake desktop apps for Anthropic's Claude and OpenAI's ChatGPT, host them on GitHub, and wait for curious users to download. Once installed, these apps quietly install a malware family that turns your machine into a mining rig. ### How the Scam Works The attackers don't just throw up any old file. They use signed executables, which makes Windows and macOS trust them more easily. That little "verified publisher" badge? It's a lie, but it's a convincing one. - They create GitHub repositories with names like "GPT-5.6 Sol" and "GPT-6 Astra"—sounds official, right? - The executables are code-signed, so they slip past some security warnings. - Once installed, they deploy a loader that fetches and runs a cryptocurrency miner. - Your computer slows down, your electricity bill goes up, and someone else gets rich. ### Why This Matters for Antidetect Browser Users If you're using antidetect browsers to manage multiple accounts, you're already careful about your digital footprint. But this attack isn't about browser fingerprints—it's about what you download. One wrong click, and your whole system is compromised. And if you're running multiple profiles on a single machine, a miner could affect all of them. > "The irony is that people looking for the latest AI tools are often the same ones who value privacy and security. That's exactly what makes them a target." — Michael Miller, Lead Antidetect Browser Strategist & Architect ### How to Spot a Fake AI App Before you download any AI desktop app, do a quick gut check: - Is it hosted on an official domain? If it's on GitHub under a random username, be skeptical. - Does the publisher name match the official company? OpenAI and Anthropic have known, verifiable publishers. - Are there any reviews or mentions from trusted sources? A quick search can save you hours of headache. - Check the file size and permissions. A simple chat app shouldn't need admin rights or access to your entire file system. ### The Bottom Line The Yoba campaign is a reminder that convenience often comes at a cost. If you're eager to try the next big AI model, stick to official channels. Don't let a fake ChatGPT app turn your computer into someone else's crypto farm. Stay safe out there—and keep your antidetect browser profiles clean.