According to a report by cybersecurity research firm Check Point Research (CPR), cybercriminals are exploiting the hype around artificial intelligence (AI) technology by secretly installing cryptocurrency mining malware through fake desktop applications that mimic popular AI tools like ChatGPT and Claude. Hackers promote these malicious applications by setting up fake GitHub repositories and dedicated websites, and manipulate search engine optimization (SEO) to rank them highly. The attackers use DLL side-loading techniques, bundling malicious DLL files with legitimate digitally signed executables, making it difficult for victims to detect. Once executed, the XMRig malware quietly exploits the victim's computing resources to mine digital assets for the attackers. The malware also has the ability to sense user activity and pause mining to evade detection, as well as other techniques that hinder security investigations. The first related GitHub repository appeared in July 2026, and malicious download activity began in late August. CPR researchers warn that while the primary payload is currently a cryptocurrency miner, the YobaLoader malware could be used to deploy other types of malware in the future.