Check Point Research published 'Tricks from the Past deployed via signed ChatGPT and Claude binaries' on 27 October 2026.

It says it discovered a campaign it tracks as Yoba in which attackers create fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and that "The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading".

Check Point says GitHub.io pages were used to describe the capabilities of the software while the malware was hosted as a GitHub release, that the projects still appear among the top results on Google, most likely due to SEO poisoning, and that the campaign avoids dedicated command-and-control infrastructure by relying on Telegram, Tor, Catbox, and DNS over HTTPS.

It says the actor shows indicators that suggest Russian origins. (source: Check Point Research) The Hacker News reported on 29 October that the downloaded payload is injected into svchost.exe, resulting in the execution of an XMRig cryptocurrency miner. (source: The Hacker News)