That "ChatGPT Desktop App" You Found on Google Might Be Malware: 4 Rules to Spot a Fake

Last verified: October 29, 2026, 9:36 AM ET.

Short answer

Not always. This month, security researchers found fake "ChatGPT" and "Claude" apps on GitHub, a site where programmers share software, that ranked high on Google. Another security company found fake "Download Claude" pages that ran as paid Google ads. Get AI apps only from the company's own site or an official app store, check the address, and never paste a command a web page gives you.

What happened

Fake apps on GitHub. Check Point Research reported on October 27 that attackers built fake GitHub projects "that pretend to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus." Check Point says the projects did not fake their popularity but "still appear among the top results on Google," most likely through SEO poisoning, which means tuning a page so it ranks high in search results.

A real program used as cover. Inside the downloads, Check Point found a genuine, signed Setup.exe from OpenAI or Anthropic sitting next to a malicious file. The real program loads the bad file, so the package can look official when it isn't. In the attacks Check Point saw, the final result was a hidden program that uses the computer's power to mine cryptocurrency. Check Point warns the malicious file can bring in other software too, and that "future waves may deliver different malware families." As CSO Online (October 28) put it, a signature on one file doesn't prove the whole download is safe.

Fake install pages on Claude's own website. This is a separate campaign. Cybersecurity News (October 27), reporting on Gen Digital research published October 26, says attackers made fake "Download Claude" pages on claude.ai using its normal sharing features, which let any user publish a page. These are user-generated pages, not pages Anthropic published, and the site shows only a thin "user-generated and unverified" banner. The attackers paid for Google ads to put the pages near the top of search results. The pages had no installer. They told Mac users to copy a command and paste it into Terminal, which installed a program built to steal passwords, browser sessions and crypto wallets. A Windows version had a similar keyboard trick.

None of these sources say OpenAI's or Anthropic's own downloads were tampered with. The traps were the fake projects, the ads and the copy-and-paste steps around them.

4 rules to spot a fake AI app

Get the app from the company itself. Type the company's address yourself, use a bookmark, or install from an official app store. Don't download from a search ad, a GitHub project, or a "how to install" guide. Gen Digital, as reported by Cybersecurity News, gives Anthropic's real download page as claude.com/download.
Check the address and the label, not just the logo. The web address should be exactly the company's own, letter for letter. On a site where anyone can publish a page, like claude.ai, a "user-generated" label means a stranger made it. Gen Digital says to treat that label as a warning.
Never paste a command a web page tells you to run. A real app gives you an installer or an app-store button. "Open Terminal, paste this, press Enter" is the trap described above. And if an AI app you didn't plan to install asks for administrator access, stop and ask someone.
Keep a person in the loop before anything new goes on a work computer. Keep one short list of approved AI apps and where to get each one, and have someone check before anyone installs something that isn't on it. Work computers usually also handle banking, email and customer records.

If someone already installed one: disconnect that computer from the internet and stop using it for work. From a different device, change important passwords, sign out of all sessions, and turn on two-step sign-in. That follows Gen Digital's advice as reported by Cybersecurity News, which says to assume the computer is fully compromised. Then get help checking or cleaning it before it goes back into use.

What High Power can do

We can do a one-time look at the AI apps on your business computers and help you write a short list of approved tools and where to get each one. You stay in control of your accounts. We never ask for your passwords or log into your accounts for this review.

Think you or a staff member may have installed a fake? Call or text (757) 869-4742, or email contact@highpower.tech.

This post was drafted with AI and approved for publishing by a person at High Power Technical Solutions.

Sources

Check Point Research, "Tricks from the Past deployed via signed ChatGPT and Claude binaries," October 27, 2026. https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
CSO Online (Gyana Swain), "Fake ChatGPT, Claude apps spread malware via signed AI binaries," October 28, 2026. https://www.csoonline.com/article/4241634/fake-chatgpt-claude-apps-spread-malware-via-signed-ai-binaries.html
Cybersecurity News (Tushar Subhra Dutta), "Hackers Abuse Claude's Official Website and Google Ads to Spread Malware," October 27, 2026 (reports Gen Digital research published October 26, 2026). https://cybersecuritynews.com/claudes-official-website/

Sources last checked: October 29, 2026, 9:36 AM ET.