If someone on your team installed a ChatGPT or Claude desktop app from a GitHub page, a search result or a file someone sent over, disconnect that computer from the network now. Fake ChatGPT desktop app malware is the subject of a Check Point Research report dated October 27, 2026, and the fix for an already-installed copy starts with containment, not research.
Keep the file path and the timestamps of whatever was downloaded, tell whoever handles your IT, and leave the files alone. After that come the other steps, in the order you will act on them: get the real app, check the other computers, and decide whether you need help.
You do not need a security service to click an official download link, and you can run the first check on each computer yourself. An outside person earns the fee in a few specific situations, such as an installer that ran or a computer that reached business accounts.
Key Takeaways
A computer that ran an unofficial installer comes off Wi-Fi and the wired network before anything else, and the download's path and timestamps are kept.
Check Point found genuine signed OpenAI and Anthropic files sitting beside a malicious winmm.dll, so a valid signature on Setup.exe does not clear the whole ZIP.
ChatGPT comes from chatgpt.com/download or the Microsoft Store on Windows, and Claude comes from claude.com/download.
Keep the evidence, have IT or a responder examine the machine, and change passwords from a different, clean device if anyone signed in on it.
Disconnect the computer first, then tell IT and keep the evidence
CISA's ransomware guidance puts it in five words: "Isolate the infected computer immediately." The same advice applies to any machine you think ran a fake installer. If you cannot unplug it from the network, CISA says to power it off when that is appropriate.
Do this in order, and do it before you read anything else about the campaign:
- Turn off Wi-Fi and unplug the network cable.
- Tell the person responsible for IT or security, even if that person is you or an outside contractor.
- Write down the file's path and its date and time, and leave the files where they are. Do not open or run them again.
- Stop using that computer for email, banking, your password manager and any business system.
- If anyone signed in to accounts on it, change those passwords from a different, clean device.
Each step has a reason. A connected computer can reach shared files and accounts, and a running miner or loader can keep working while you decide what to do.
Deleting the ZIP file to make the problem go away is the step that causes trouble later. If an investigator needs to know what ran, the file and its timestamps are the evidence. NIST's malware incident guide covers the same containment and handling routine.
The fake downloads put malware next to genuine signed files
Check Point Research describes a campaign it tracks as Yoba. The attackers built fake GitHub projects that pretend to be desktop apps such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point says the downloads were hosted in those projects' repositories and releases, with GitHub Pages used as landing pages. The report is titled "Tricks from the Past deployed via signed ChatGPT and Claude binaries".
The ZIP files in those releases hold real, digitally signed executables from OpenAI or Anthropic, with a malicious file named winmm.dll placed next to them. OpenAI and Anthropic were not hacked. The signed files are genuine, and the malware sat beside them.
How a fake download runs, per Check Point Research
- 1
Step 1
Someone downloads a ZIP from a fake project, such as sol-setup.zip, Setup-Claude.zip or GPT-6-Astra-Setup.zip.
- 2
Step 2
The ZIP holds a genuine signed Setup.exe from OpenAI or Anthropic and a malicious winmm.dll beside it.
- 3
Step 3
Running the signed Setup.exe makes Windows load the malicious DLL, a technique called DLL sideloading.
- 4
Step 4
The dropper fetches a component named YobaLoader, which can inject or execute further payloads.
- 5
Step 5
The final payload Check Point observed was XMRig 6.26.0, cryptocurrency-mining software that connects through Tor.
A miner spends your computer's processor time and electricity on someone else's coins, which is why high CPU use that never settles is one of the signs. Because YobaLoader can run other payloads, a computer that ran the installer deserves a proper look instead of a quick delete. Microsoft documents how Authenticode signing works, and a valid signature on one executable does not prove that the entire downloaded package is safe.
ChatGPT and Claude each have one official download page
OpenAI's download page is chatgpt.com/download. OpenAI's Help Center says the Windows app comes from the Microsoft Store, and its macOS guidance points to chatgpt.com/download, which detects your Mac and gives you the right installer. For a company with managed computers, OpenAI documents deployment through Microsoft Intune and winget using the Microsoft Store source.
Anthropic's route is claude.com/download, where you choose macOS or Windows. Its installation article says to open the app from the Applications folder on a Mac or the Start menu on Windows.
| App | Official route | What the vendor documents |
|---|---|---|
| ChatGPT on Windows | Microsoft Store | OpenAI Help says the Windows app is downloaded from the Microsoft Store |
| ChatGPT on Mac | chatgpt.com/download | The page detects the Mac hardware and provides the correct installer |
| ChatGPT on company computers | Microsoft Intune or winget, Microsoft Store source | OpenAI documents both for administrators |
| Claude on Mac or Windows | claude.com/download | Choose macOS or Windows, then open the app from Applications or the Start menu |
| Any app, any vendor | A GitHub page, a file-sharing site, a search ad or an unfamiliar domain | Not an official desktop-app route |
Type the address yourself or use a bookmark. A search result or an ad at the top of the page is not a guarantee that you are on the vendor's site, and the names the fake projects used, like Sol and Astra, sound like new releases people might look for.
A ten-minute check on each computer shows whether a fake got in
Run this on every machine where someone installs AI apps, not only the one that raised the alarm. The report lists the exact ZIP names and file names to look for, so most of the check is reading and matching.
Ten-minute check for each computer
Open the installed-apps list, find ChatGPT, Claude and any AI app you do not recognize, and read the publisher, install date and install path.
Confirm each copy came from chatgpt.com/download, the Microsoft Store, claude.com/download or a company deployment.
Look for sol-setup.zip, Setup-Claude.zip, GPT-6-Astra-Setup.zip or any ZIP you cannot place.
Look for a Setup.exe or winmm.dll you did not expect, and the folder %TEMP%\torbundle\data from Check Point's list.
Watch for Tor processes, high CPU use that never settles, unfamiliar startup entries and unexpected scheduled tasks.
If any copy came from a GitHub page, a file-sharing site or Telegram, treat that computer as a suspect: disconnect it, record the path and timestamps, and leave the files in place. Check Point also lists a Local\WindowsSecurity mutex and hidden PowerShell execution among its indicators, which are things an IT person or responder looks for, not a task for a first pass.
A clean result means no sign of the known files and behaviors, and a company deployment from the official routes is the safest way to keep it that way. After a suspect installer has run, a clean-looking check is not proof, and the machine still needs a proper examination.
Deleting the app does not clean the computer
NIST's malware guidance recommends containment by disconnecting affected computers from the network or shutting them down, and cautions that isolation alone does not prove the malware is gone. Uninstalling the visible app has the same limit. It may leave scheduled tasks, startup entries or other payloads behind.
CISA's incident-response playbook adds credentials to the routine: where compromise is suspected, change administrative passwords, private keys and application secrets. Do that from a different device, since anything typed on the suspect computer could be seen by whatever is running on it. NIST SP 800-83 is the longer reference your IT person may want.
When there is any doubt, the dependable ending is a rebuild from trusted media, restoring clean data, and then installing the genuine app from the official page. If email or customer accounts were open on the machine, what to do when a business email account is hacked covers the next round of cleanup.
Professional help fits when the installer ran or the scope is unclear
Checking the source and the first ten minutes of triage are jobs you can do alone. Outside help earns its fee when the situation has uncertainty with business consequences.
| Situation | Your first move | Who should examine it |
|---|---|---|
| A download was never opened | Delete nothing yet, record the path and timestamps | You, unless the source is unknown |
| The installer ran | Disconnect the computer, tell IT | IT or an incident responder |
| The source of the download is unknown | Disconnect and keep the files | IT or an incident responder |
| The computer reached business accounts or shared files | Change passwords from a clean device | IT or a responder, to check what it could reach |
| Several machines may be involved | Run the ten-minute check on each | IT or a responder, to check the whole office |
| You need evidence that the environment is clean | Preserve files and logs | A responder who can document the work |
A fake desktop app is also a different problem from a fake custom GPT that tells someone to paste a command, which has its own write-up in fake ChatGPT custom GPTs and ClickFix malware. The shared fix is a written rule about where software comes from. An AI use policy for a small business is a good place to put the rule that desktop apps come from the vendor's page or the Microsoft Store only, and that someone approves any other installer first.
Can you tell a real download from a fake one?
Pick an answer to begin.
1. Where does OpenAI say the ChatGPT Windows app is downloaded from?
2. A ZIP from an unofficial site holds a signed Setup.exe from OpenAI. What does the signature tell you?
3. Someone ran a suspect installer yesterday. What comes first?
Frequently Asked Questions About Fake ChatGPT Desktop App Malware
Where should I download the ChatGPT desktop app?
Use chatgpt.com/download or the Microsoft Store on Windows. OpenAI's Help Center names the Microsoft Store as the Windows source, and its macOS guidance points to chatgpt.com/download.
Where should I download Claude for Windows or Mac?
Use claude.com/download and choose macOS or Windows. Anthropic's installation article walks through opening the app afterward.
Were OpenAI or Anthropic hacked?
No. The signed files in these fake downloads are genuine OpenAI and Anthropic files, and the attackers placed their own malware beside them.
Can a signed file still be part of malware?
Yes. Check Point reports genuine signed executables being used to load a malicious winmm.dll through DLL sideloading, so the signature on one file does not clear the rest of the package.
What should I do if I already installed one?
Disconnect that computer, tell IT, and keep the file path and timestamps. Do not run the files again, and change passwords from a different, clean device if anyone used the computer to sign in.
Is deleting the app enough?
Not on its own. Scheduled tasks, startup entries and other payloads can remain, so IT or a responder should examine the computer, and a rebuild from trusted media is the sure ending when there is doubt.
Final Thoughts
Fake ChatGPT desktop app malware works because the files look right: genuine signed OpenAI and Anthropic executables, with the malicious winmm.dll tucked beside them. Your defenses are simple ones. Download from chatgpt.com/download, the Microsoft Store or claude.com/download, disconnect any computer that ran something else, and keep the evidence until someone has examined it.
Do the ten-minute check on every machine once, write down where software is allowed to come from, and the next fake with a new name is far less likely to reach a work computer. The gain is quiet: nothing slows down, and nobody wonders why a computer is working so hard.
If a suspect installer ran, or you cannot tell what a computer reached, Web Leveling can review the situation with you through a website security audit and tell you plainly whether the first-pass checks were enough. We work with small and medium businesses across the country and overseas. Contact us about a security review and we will look at what ran and what it could reach.
Terms
Words used in this post
Tap a term to see what it means.
DLL sideloading. A technique where a trusted program loads a malicious library file placed next to it, so the trusted program runs the attacker's code.
winmm.dll. A Windows library file name; Check Point found a malicious file with this name placed next to genuine signed OpenAI and Anthropic executables.
Digital signature. A mark on a file that identifies who signed that file; it does not vouch for other files in the same package.
XMRig. Cryptocurrency-mining software, the final payload Check Point observed in this campaign.
Tor. Software that routes internet traffic through relays to hide where it goes; the miner in this campaign connected through it.
Isolation. Cutting a computer off from the network so it cannot talk to other systems, the first containment step in CISA and NIST guidance.
