Fake ChatGPT and Claude Installers Delivering Yoba Malware: Detection and Remediation Guide for SOC Teams

---
title: Fake ChatGPT or Claude Installer Execution from User-Writable Path
id: 8f2c1a94-3b7d-4e61-9c05-2a6d4f8b1e73
status: experimental
description: Detects execution of binaries named after ChatGPT or Claude installers from user-writable directories, consistent with trojanized AI assistant installers distributing Yoba malware. Legitimate desktop clients install to Program Files via official channels.
references:
  - https://www.infosecurity-magazine.com/news/attackers-hide-malware-behind/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains:
      - 'chatgpt'
      - 'claude'
      - 'openai'
      - 'anthropic'
  selection_path:
    Image|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\Desktop\'
  condition: selection_name and selection_path
falsepositives:
  - Portable or unofficial AI client wrappers legitimately used by developers (review signer and hash before whitelisting)
level: high
---
title: AI-Branded Process Spawning Script Interpreter or Command Shell
id: 4d9e7b23-6c1f-4a58-b732-9e0c5d3a8f46
status: experimental
description: Detects processes named after ChatGPT, Claude, or related AI brands spawning cmd, PowerShell, wscript, mshta, or rundll32. Legitimate AI desktop clients do not launch script interpreters; this behavior is consistent with Yoba malware staging after trojanized installer execution.
references:
  - https://www.infosecurity-magazine.com/news/attackers-hide-malware-behind/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'chatgpt'
      - 'claude'
      - 'openai'
      - 'anthropic'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate AI desktop clients do not spawn script interpreters. Investigate any hit.
level: critical
---
title: Persistence Registration Masquerading as AI Assistant Updater
id: 1c5a8f47-2d9b-4e36-a814-7f3b6c0d9e25
status: experimental
description: Detects Run key or scheduled task persistence entries referencing ChatGPT, Claude, OpenAI, or Anthropic branding that point to binaries in user-writable paths. Trojanized installers frequently register persistence disguised as an AI client auto-updater.
references:
  - https://www.infosecurity-magazine.com/news/attackers-hide-malware-behind/
  - https://attack.mitre.org/techniques/T1060/
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - 'chatgpt'
      - 'claude'
      - 'openai'
      - 'anthropic'
  selection_path:
    Details|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'
  condition: selection_key and selection_value and selection_path
falsepositives:
  - Legitimate AI clients installed per-user may register Run keys; verify the binary signer is the genuine vendor before tuning.
level: high

let AiBrandTerms = dynamic(["chatgpt", "claude", "openai", "anthropic"]);
let SuspiciousPaths = dynamic(["\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\Desktop\\", "\\Users\\Public\\"]);
let ScriptChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe"]);
let SuspectProcesses = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has_any (AiBrandTerms) or ProcessCommandLine has_any (AiBrandTerms)
    | where FolderPath has_any (SuspiciousPaths)
    | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName;
let ChildSpawns = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (AiBrandTerms)
    | where FileName in~ (ScriptChildren)
    | project TimeGenerated, DeviceName, AccountName, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine, ParentProcess=InitiatingProcessFileName, ParentCommandLine=InitiatingProcessCommandLine;
let PersistenceCheck = DeviceRegistryEvents
    | where TimeGenerated > ago(7d)
    | where RegistryKey has_any ("\\Run", "\\RunOnce")
    | where RegistryValueData has_any (AiBrandTerms) and RegistryValueData has_any (SuspiciousPaths)
    | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData;
SuspectProcesses
| union ChildSpawns
| union PersistenceCheck
| sort by TimeGenerated desc

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("chatgpt", "claude", "openai", "anthropic")
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\Downloads\\")
| where RemotePort in (80, 443, 8080, 8443)
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP), RemoteUrls = make_set(RemoteUrl)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| sort by Connections desc

-- Hunt for trojanized ChatGPT/Claude installers in user-writable paths
-- and verify Authenticode signer identity
SELECT FullPath,
       Size AS FileSize,
       Mtime AS ModifiedTime,
       hash(path=FullPath).SHA256 AS SHA256,
       authenticode(filename=FullPath).SignerCertificate.Subject AS SignerSubject,
       authenticode(filename=FullPath).Status AS SignatureStatus
FROM glob(globs=[
    'C:/Users/*/Downloads/*chatgpt*',
    'C:/Users/*/Downloads/*claude*',
    'C:/Users/*/Downloads/*openai*',
    'C:/Users/*/Downloads/*anthropic*',
    'C:/Users/*/AppData/Local/**/chatgpt*.exe',
    'C:/Users/*/AppData/Local/**/claude*.exe',
    'C:/Users/*/AppData/Roaming/**/chatgpt*.exe',
    'C:/Users/*/AppData/Roaming/**/claude*.exe',
    'C:/Windows/Temp/*chatgpt*',
    'C:/Windows/Temp/*claude*'
])
WHERE FullPath =~ '(?i)\\.(exe|msi|bat|ps1|dll)$'
ORDER BY ModifiedTime DESC

-- Sweep Run keys for persistence entries referencing AI assistant branding
SELECT Key.FullPath AS RegistryKey,
       ValueName,
       ValueData,
       Key.Mtime AS KeyModified
FROM read_reg_key(globs=[
    'HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*',
    'HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/RunOnce/*',
    'HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*'
])
WHERE ValueData =~ '(?i)(chatgpt|claude|openai|anthropic)'
   AND ValueData =~ '(?i)(appdata|temp|users\\public)'

# Audit for trojanized ChatGPT/Claude installers and Yoba staging artifacts
# Run elevated. Output is written to C:\Windows\Temp\FakeAiAudit_<hostname>.csv

$brandTerms = 'chatgpt|claude|openai|anthropic'
$searchRoots = @(
    "$env:SystemDrive\Users",
    "$env:SystemDrive\Windows\Temp",
    "$env:ProgramData"
)

$findings = foreach ($root in $searchRoots) {
    Get-ChildItem -Path $root -Recurse -Include *.exe,*.msi,*.dll,*.bat,*.ps1 -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match $brandTerms } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature -FilePath $_.FullName
            [PSCustomObject]@{
                ArtifactType    = 'File'
                Path            = $_.FullName
                SHA256          = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                SignatureStatus = $sig.Status
                Signer          = $sig.SignerCertificate.Subject
                LastWriteTime   = $_.LastWriteTime
            }
        }
}

# Flag anything not signed by the legitimate vendor (or unsigned entirely)
$suspicious = $findings | Where-Object {
    $_.SignatureStatus -ne 'Valid' -or
    ($_.Signer -notmatch 'OpenAI' -and $_.Signer -notmatch 'Anthropic')
}

# Audit Run keys and RunOnce for AI-branded persistence
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
$persistence = foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty -Path $key).($_.Name)
            if ($val -match $brandTerms) {
                [PSCustomObject]@{
                    ArtifactType = 'Persistence'
                    Path         = "$key -> $($_.Name)"
                    SHA256       = ''
                    SignatureStatus = ''
                    Signer       = $val
                    LastWriteTime = ''
                }
            }
        }
    }
}

# Audit scheduled tasks for AI-branded persistence
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskName -match $brandTerms -or ($_.Actions.Execute -match $brandTerms)
} | ForEach-Object {
    [PSCustomObject]@{
        ArtifactType = 'ScheduledTask'
        Path         = $_.TaskPath + $_.TaskName
        SHA256       = ''
        SignatureStatus = ''
        Signer       = ($_.Actions.Execute -join '; ')
        LastWriteTime = ''
    }
}

$report = $suspicious + $persistence + $tasks
$outFile = "C:\Windows\Temp\FakeAiAudit_$env:COMPUTERNAME.csv"
$report | Export-Csv -Path $outFile -NoTypeInformation
Write-Host "[+] Audit complete. $($report.Count) suspicious artifacts found. Report: $outFile" -ForegroundColor Yellow
$report | Format-Table -AutoSize