Fake ChatGPT and Claude installers hosted on GitHub and SourceForge have been used to spread DinDoor malware, a backdoor capable of installing a powerful remote access trojan on Windows computers.
Malwarebytes researchers documented the campaign on May 26, 2026. Attackers used compromised YouTube channels to promote fake AI software downloads, leading users to malicious repositories that appeared to offer legitimate applications and plugins.
The danger goes beyond a fake installer. Once executed, the malware can establish persistent access, steal sensitive information, run commands, and allow attackers to control infected systems remotely.
For more examples of threats involving AI software and developer tools, explore our AI Cyber Threats and Agentic Security Hub.
Fake ChatGPT and Claude Installers: Key Findings
- Researchers: Malwarebytes Threat Intelligence.
- Original report: May 26, 2026.
- Delivery platforms: GitHub and SourceForge.
- Impersonated software: ChatGPT, Claude, AutoTune, Kontakt, Ableton Live, and other products.
- Malware: DinDoor backdoor and a Deno-based remote access trojan.
- Distribution: Compromised YouTube channels with promotional videos totaling more than 50,000 views.
- Impact: Credential theft, remote control, additional malware execution, and access to sensitive files.
How Fake GitHub Repositories Infect Windows Users
The attack begins when someone looking for AI software encounters a promotional video or a repository advertising a free installer.
The GitHub page may resemble a normal open-source project, complete with installation instructions and familiar software branding.
Instead of providing the promised application, the instructions direct users to download and execute a malicious MSI package or PowerShell script.
Malwarebytes found that these installers could deploy scripts that install the legitimate Deno JavaScript runtime using Windows package managers such as WinGet or Scoop.
The attackers then abuse that runtime to execute malicious JavaScript.
Why this works: Deno itself is a legitimate developer tool. The danger comes from attacker-controlled scripts running through it with extensive permissions.
Using a trusted runtime also makes the infection chain less obvious than a conventional standalone malware executable.
What Can DinDoor Malware Do?
After installation, DinDoor communicates with attacker-controlled infrastructure, collects information about the infected computer, and downloads additional payloads.
Malwarebytes also analyzed a Deno-based remote access trojan delivered through the campaign.
| Capability | Potential Impact |
|---|---|
| Remote command execution | Attackers can run commands and additional programs. |
| Information theft | Browser data, credentials, and cryptocurrency information may be exposed. |
| Screen capture | Attackers can observe sensitive activity. |
| SOCKS5 proxy | The infected device can relay attacker-controlled traffic. |
| Persistence | Malware can attempt to run again after a restart. |
One notable feature uses Microsoft Edge and WebRTC to relay screen activity to an operator, making remote monitoring possible through a legitimate browser process.
Researchers also identified a lighter RAT variant using Cloudflare Workers for command-and-control communication.
These capabilities describe malware observed in the campaign. They do not establish that every victim experienced every form of data theft or remote control.
Why GitHub and SourceForge Make the Lures Convincing
GitHub and SourceForge are legitimate software distribution platforms, but attackers can create misleading projects on them.
A familiar domain does not guarantee that every repository or download is safe.
In this campaign, compromised YouTube channels helped drive traffic to malicious projects. Attackers also rotated GitHub accounts and repositories when malicious content was removed.
Malwarebytes reported the repositories to GitHub, which removed the flagged projects.
However, removing known repositories does not prevent attackers from creating new ones.
How to Protect Yourself From Fake AI Installers
Users and IT administrators should take these precautions:
- Use official downloads: Obtain ChatGPT and Claude applications from verified vendor websites.
- Check repository ownership: Verify the project maintainer, organization, and publishing history.
- Avoid installation commands from videos: Do not execute unfamiliar PowerShell or terminal instructions copied from YouTube descriptions.
- Inspect downloaded files: Check publishers, digital signatures, and unexpected installer behavior.
- Monitor suspicious activity: Investigate unexpected Deno installations, unusual scripts, and unauthorized remote-access activity.
If a suspicious installer was executed, disconnect the affected computer from the network and involve your security team. Use a clean device to change important passwords and revoke exposed sessions or credentials.
CyberUpdates365 Analysis
This campaign demonstrates how attackers exploit trust in popular AI products and legitimate software-hosting platforms.
The underlying weakness is not a confirmed vulnerability in ChatGPT, Claude, GitHub, or Deno. It is the execution of malicious software disguised as a useful download.
For developers, the consequences can extend beyond a personal account. A compromised workstation may contain GitHub credentials, SSH keys, cloud tokens, and access to development infrastructure.
Organizations should treat unofficial AI installers as a software supply-chain risk and apply the same approval and monitoring controls used for other developer dependencies.
Bottom line: A GitHub repository or YouTube installation tutorial is not proof of authenticity. Verify the publisher before running downloaded software.
For another example of criminals impersonating an AI development tool, read our report on fake Claude Code download lures spreading malware through Windows utilities.
