Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Fake ChatGPT and Claude desktop apps on GitHub use DLL sideloading to deploy YobaLoader, which retrieves and executes an XMRig miner.
More info