Threat actors are leveraging artificial intelligence (AI) desktop applications to deploy malicious loaders and cryptocurrency miners. This campaign, known as Yoba, targets platforms like Anthropic Claude and OpenAI ChatGPT by creating counterfeit GitHub projects.
Fake AI Applications Deliver Malware
The attackers have developed GitHub repositories that masquerade as desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects, in reality, distribute malware known as YobaLoader. By placing malware alongside legitimate, signed executables from OpenAI and Anthropic, the attackers exploit a technique called DLL sideloading to circumvent security measures.
To enhance credibility, the perpetrators establish GitHub.io pages detailing the software’s capabilities. Although these projects do not manipulate popularity through ghost networks, they employ SEO poisoning to ensure their links rank highly in Google search results.
Technical Details of the Yoba Campaign
Within these repositories, ZIP archives contain two critical components: a legitimate OpenAI Codex or Claude executable under the name ‘Setup.exe’ and a malicious DLL named ‘winmm.dll.’ The malicious DLL, YobaDropper, checks for a specific checksum and employs anti-analysis techniques to avoid detection.
YobaDropper utilizes extensive pre-checks, including a prolonged sleep function and bypassing systems with certain keyboard layouts, primarily those from Russia and neighboring countries. This strategy reduces the likelihood of malware execution in sandboxed or analytical environments.
Advanced Evasion Techniques
The secondary component, YobaLoader, implements similar anti-sandbox measures. It executes only when called by ‘wmpdmc.exe,’ a process involved in sideloading additional components. YobaLoader’s primary functions include downloading an image from a Telegram channel, generating a domain through a domain generation algorithm, and retrieving a command from Google’s DNS-over-HTTPS API.
By using common file-hosting services and DNS-over-HTTPS, the threat actors aim to obscure their command-and-control communications, making detection challenging for standard security solutions.
Conclusion and Future Implications
The Yoba campaign highlights the evolving strategies of cybercriminals who exploit trusted platforms and the growing interest in AI tools. By integrating their malicious code with reputable software and distributing it via GitHub, they minimize the chances of immediate detection.
This incident underscores the importance of vigilant cybersecurity practices and the need for advanced detection mechanisms to identify and neutralize threats that leverage legitimate platforms deceptively.
