Yoba Campaign: Fake ChatGPT and Claude Desktop Apps Abuse Signed Executables — Detection and Remediation Guide

---
title: Fake AI Desktop App Loader Spawning Scripting or Mining Payloads
id: 8f2c1f6a-7b5d-4c9e-a2d1-6e4f9b1a2c30
status: experimental
description: Detects executables themed as ChatGPT, Claude, GPT, Astra, Sol, or Opus launching command interpreters, script hosts, or miner-like command lines consistent with the Yoba fake AI app campaign.
references:
  - https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
  - https://attack.mitre.org/techniques/T1036/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/10/31
tags:
  - attack.execution
  - attack.resource_hijacking
  - attack.t1036
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'gpt-5.6 sol.exe'
      - 'gpt-6 astra.exe'
      - 'claude opus.exe'
      - 'chatgpt.exe'
      - 'claude.exe'
      - 'openai.exe'
    CommandLine|contains:
      - 'gpt-5.6 sol'
      - 'gpt-6 astra'
      - 'claude opus'
  selection_child:
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'rundll32.exe'
      - 'regsvr32.exe'
      - 'mshta.exe'
      - 'xmrig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Official AI desktop applications updating or launching diagnostics. Validate publisher, source URL, package hash, and enterprise software inventory before suppression.
level: high
---
title: Outbound Stratum Mining Traffic From Non-Browser Processes
id: 3b9d7e21-4a68-4d2f-9c10-7e8a5b6d1f42
status: experimental
description: Detects likely cryptocurrency miner egress by flagging non-browser processes connecting to common stratum ports or emitting stratum protocol markers.
references:
  - https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/10/31
tags:
  - attack.resource_hijacking
  - attack.command_and_control
  - attack.t1496
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 3333
      - 4444
      - 5555
      - 7777
      - 8888
      - 14444
      - 45700
  selection_process:
    Image|endswith:
      - 'xmrig.exe'
      - 'claude opus.exe'
      - 'gpt-6 astra.exe'
      - 'gpt-5.6 sol.exe'
      - 'powershell.exe'
      - 'rundll32.exe'
      - 'notepad.exe'
  filter_browsers:
    Image|endswith:
      - 'chrome.exe'
      - 'msedge.exe'
      - 'firefox.exe'
  condition: selection_port and selection_process and not filter_browsers
falsepositives:
  - Approved research mining, blockchain development, or sanctioned pool connectivity. In most enterprises these destinations should be rare and easy to baseline.
level: high

let Lookback = 14d;
let FakeAINames = dynamic(['gpt-5.6 sol','gpt-6 astra','claude opus','chatgpt','claude','openai','astra','opus']);
let MinerTerms = dynamic(['stratum+tcp','stratum+ssl','xmrig','--donate-level','--coin','--algo','-o pool','worker','wallet']);
DeviceProcessEvents
| where TimeGenerated >= Lookback
| extend ProcLower = tolower(FileName), CmdLower = tolower(ProcessCommandLine), FolderLower = tolower(FolderPath)
| where ProcLower has_any (FakeAINames) or CmdLower has_any (FakeAINames) or CmdLower has_any (MinerTerms) or FolderLower has_any (dynamic(['appdata','temp','programdata']))
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ProcessVersionInfoCompanyName, ProcessVersionInfoProductName
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated >= Lookback
    | where RemotePort in (3333,4444,5555,7777,8888,14444,45700) or RemoteUrl has_any (MinerTerms)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
) on DeviceName, $left.FileName == $right.InitiatingProcessFileName
| sort by TimeGenerated desc;

-- Yoba fake AI app endpoint sweep: suspicious AI-themed processes, user-profile staging, and miner egress
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(gpt-5\.6 sol|gpt-6 astra|claude opus|stratum\+tcp|stratum\+ssl|xmrig|--donate-level|--algo|worker|wallet)'
   OR Name =~ '(?i)(gpt|astra|opus|claude|chatgpt|xmrig)'
   OR Exe =~ '(?i)(appdata|temp|programdata)'

-- Persistence and dropped artifacts in common user-writable locations
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=['C:/Users/*/AppData/Roaming/*/*gpt*', 'C:/Users/*/AppData/Roaming/*/*claude*', 'C:/Users/*/AppData/Local/*/*astra*', 'C:/ProgramData/*/*opus*', 'C:/Users/*/Downloads/*GPT*', 'C:/Users/*/Downloads/*Claude*'])
WHERE FullPath =~ '(?i)(gpt-5\.6|gpt-6|astra|opus|claude|chatgpt|xmrig|miner)'

-- Current mining-style connections
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemotePort in (3333, 4444, 5555, 7777, 8888, 14444, 45700)
   AND NOT Name =~ '(?i)(chrome|msedge|firefox|Teams|slack)'

# Audit-first triage for Yoba-style fake AI app loaders and miners. Review output before removal.
$ErrorActionPreference = 'SilentlyContinue'
$terms = 'gpt-5.6 sol|gpt-6 astra|claude opus|chatgpt|claude|openai|astra|opus|xmrig|stratum'
$report = Join-Path $env:ProgramData 'Yoba_Triage_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt'

"=== Processes ===" | Out-File $report
Get-CimInstance Win32_Process | Where-Object { $_.Name -match $terms -or $_.CommandLine -match $terms -or $_.ExecutablePath -match 'AppData|Temp|ProgramData' } | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine | Format-List | Out-File $report -Append

"=== Run Keys ===" | Out-File $report -Append
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce' | Out-String | Select-String -Pattern $terms | Out-File $report -Append

"=== Scheduled Tasks ===" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.TaskName -match $terms -or $_.Actions.Execute -match $terms -or $_.Actions.Arguments -match $terms } | Select-Object TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute + ' ' + $_.Actions.Arguments)}} | Format-List | Out-File $report -Append

"=== Network Ports ===" | Out-File $report -Append
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 3333,4444,5555,7777,8888,14444,45700 } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} | Format-Table | Out-File $report -Append

"=== Egress Blocks for Common Stratum Ports ===" | Out-File $report -Append
New-NetFirewallRule -DisplayName 'SECARSENAL Block Outbound Stratum TCP' -Direction Outbound -Protocol TCP -RemotePort 3333,4444,5555,7777,8888,14444,45700 -Action Block -Profile Any | Out-File $report -Append

"Report written to $report. Validate publisher, hash, source repository, and business need before deleting files or disabling tasks."