Check Point Research says a malware campaign it calls Yoba is hiding a cryptocurrency miner behind legitimate, signed ChatGPT and Claude installers, distributed through fake GitHub projects that pose as desktop AI apps. The report, published October 27, found no evidence that OpenAI, Anthropic, ChatGPT or Claude were compromised. The attackers bundle genuine signed executables with a malicious DLL of their own.
The lures impersonate products named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point tracked four GitHub repositories with matching GitHub Pages sites whose download buttons point to ZIP files hosted as GitHub releases. The repositories had no inflated stars or forks but still ranked near the top of Google results, which the researchers attribute to SEO poisoning.
Each ZIP contains a real signed Setup.exe from OpenAI or Anthropic alongside a malicious file named winmm.dll. When the user runs the installer, Windows loads the attacker's DLL from the same folder, a technique known as DLL sideloading, so the malicious code runs inside a trusted, signed process.
Key facts
- 01Check Point Research disclosed the Yoba malware campaign on October 27, 2026.
- 02Fake GitHub projects posed as GPT-5.6 Sol, GPT-6 Astra and Claude Opus desktop apps and ranked high in Google results.
- 03ZIPs pair genuine signed OpenAI and Anthropic Setup.exe files with a malicious winmm.dll loaded via DLL sideloading.
- 04The final payload was XMRig 6.26.0, mining over Tor; the loader can also deliver other executables or PowerShell scripts.
- 05The earliest YobaDropper variant dates to early June 2026, when it was sideloaded by a fake Cursor.exe.
That first stage, which Check Point calls YobaDropper, checks that it was launched by the expected Setup.exe, a test that trips up many automated sandboxes, and stalls for roughly 12.7 days if the check fails. It also requires administrator rights and skips machines whose keyboard language is Russian or one of 10 other languages from the CIS region, while explicitly exempting Ukrainian.
The dropper copies a legitimate Windows Media Player executable into a ProgramData folder, plants a second-stage loader beside it, and registers a scheduled task disguised as a Microsoft component. The task runs as Local System three minutes after boot.
The loader, YobaLoader, finds its server through an unusual chain. It downloads the profile image of a Telegram channel, derives a domain name from the image data and queries Google's DNS-over-HTTPS service for a TXT record on that domain. Responses are verified with an Ed25519 signature and decrypted with AES before the payload is pulled from the file host Catbox. Changing the Telegram image moves the operation to a new domain, which blunts efforts to block a single server.
In the observed campaign, the final payload was XMRig 6.26.0, a cryptocurrency miner injected into svchost.exe that communicates through Tor and pauses mining when the user is active. Check Point warns that YobaLoader is a generic loader that can deliver other Windows executables or PowerShell scripts, so an infection should be treated as a broader compromise.
The operation predates its current lures. Check Point traced the earliest YobaDropper variant to early June 2026, when it was sideloaded by a fake Cursor.exe. The first fake GPT repository has commits dated July 16, and the Claude-themed ZIP was uploaded on August 31. The report does not give download or victim counts.
Attribution remains open. The fake repositories used three uploader email addresses with commit timezones of UTC+4, UTC-4 and UTC+3, which Check Point suggests was deliberate obfuscation, while compile timestamps point to UTC-4.
Check Point recommends getting AI software only from vendor-controlled sources rather than search results or GitHub pages, limiting administrator privileges and blocking machine-generated command-and-control domains. It also notes that a valid signature on one executable does not vouch for the other files shipped in the same package.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
