- Entertainment
- Style
- Lifestyle
- Food & Drinks
- Tech & Auto
- Culture
You look for ChatGPT or Claude apps for your computer on Google Search, click on results that look right and promptly download it. Simple, right? Not this time. A new malware campaign is tricking Windows computer users with fake AI app downloads that rank high on Google Search. In fact, the files inside look like genuine ChatGPT and Claude apps installers from OpenAI and Anthropic respectively. If you downloaded one of these ZIP files but never opened it, delete it now. If you already ran the installer, deleting the app will not help you get rid of the problem. Yes, your computer has been hacked. You will need to scan your PC for malware now. Here is how to delete fake ChatGPT, Claude apps that you downloaded on your computer from links found on Google Search? The problem stems from malicious GitHub pages that carry the malware and they manage to evade most security checkpoints to appear in your Google Search results.
So, what are these fake ChatGPT and Claude apps you downloaded? Security firm Check Point Research has caught a malicious campaign named Yoba at work. The hackers set up fake GitHub pages that pose as official AI desktop apps, using names like GPT-5.6 Sol, GPT-6 Astra and Claude Opus. These pages appeared high in Google results. Whom to blame? Well, the hackers seem to have used a trick called SEO poisoning, where they game search rankings to push dodgy websites up the list.
What makes this fake app downloads campaign sneaky is that the ChatGPT and Claude apps files do not look fake. The ZIP file contains real installer files from OpenAI or Anthropic. Surprisingly, the digital signatures are valid, helping hackers to carry on their malware-spreading campaign. However, next to them sits a malicious file called winmm.dll.
When you open the genuine Setup.exe for these fake ChatGPT and Claude apps, it automatically loads the malicious, malware-laden, file sitting beside it. That’s why the signature doesn't help. It only vouches for the installer, not for the extra file hiding in the same folder.
If you run it as administrator, the malware can dig in. Researchers found that it creates a folder called WMProcess inside ProgramData. It also sets up a scheduled task disguised as a Windows Media Player component, so it restarts every time you reboot your computer.
The final payload Check Point saw was a cryptocurrency miner called XMRig. It uses your computer to mine crypto for someone else. The malware can also download other programs and scripts, so the risk goes beyond a slower computer.
It is not easy to check whether your computer has fake ChatGPT and Claude apps, but you will have to do a thorough job if you want to remove the malware. Here are the step-by-step points:
Look in your computer's downloads folder. Search for ZIP files named after GPT-5.6 Sol, GPT-6 Astra or Claude Opus, especially if they came from a GitHub page you don’t recognise.
Check for the WMProcess folder. Open C:\ProgramData and look for a folder with that name. Finding it is a warning sign, but only a proper security scan can confirm an infection.
Watch how your PC behaves. Constant high CPU usage, unusual heat and sudden slowness can all point to trouble.
Here is how to delete fake ChatGPT, Claude apps from your computer that you downloaded from links found on Google Search.
If you only downloaded the ZIP: Delete the archive and any files you extracted from it.
If you ran Setup.exe: Disconnect from the internet, then run a full scan with Windows Security.
For a deeper clean: Open Windows Security, go to Virus & threat protection, choose Scan options, then select Microsoft Defender Offline scan. Save your work first, because your PC will restart and scan outside of Windows.
Well, you have have successfully removed the fake ChatGPT and Claude apps that you downloaded on your computer, but the fact remains that you need these apps. So, here is how to download genuine ChatGPT and Claude apps. Well, skip third-party links entirely and go straight to the source:
ChatGPT: OpenAI’s official desktop download page or the Microsoft Store
Claude: Anthropic's official download page.
You can also download from Apple Store and Google Play Store.
Scammers know people generally rush to Google Search to find the links from where to download the next big AI tool. Take a few seconds to check the source, and get ChatGPT and Claude only from their official pages. If you think you installed a fake app, run a full scan today.