Cybercriminals are leveraging counterfeit ChatGPT and Claude applications to disseminate Yoba malware, pairing genuine, digitally signed apps with harmful libraries. This tactic involves using trusted software and GitHub hosting to present dangerous installers as legitimate, ultimately deploying a cryptocurrency miner on Windows systems.
Malware Campaign Tactics
The attackers exploit a method that does not necessitate breaching OpenAI or Anthropic. Instead, they place malicious files alongside authentic executables, exploiting the way these programs load their libraries. Although the signed executables remain intact, this does not ensure the safety of accompanying files.
A report from PolySwarm on November 2 highlights how Yoba combines the misuse of signed applications with environmental checks and tiered payload delivery. This assessment is based on Check Point Research’s study, which monitored fake AI repositories over a two-month period.
GitHub Repository Exploitation
Hackers have set up GitHub repositories and corresponding websites advertising fake desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Visitors are directed to download ZIP archives from GitHub, which utilize familiar branding to encourage installations.
Researchers tracked these repositories back to July 2026, with malicious versions appearing in late August and early September. Despite lacking inflated stars or forks, some projects achieved high visibility in Google searches, potentially through SEO manipulation rather than known methods.
Advanced Malware Deployment Techniques
Within the archives, a genuine signed installer initiates YobaDropper through DLL sideloading. The malicious component mimics a Windows multimedia function, yet its harmful code triggers from the entry point. This technique is not limited to AI-themed tactics; it extends to broader signed software sideloading attacks.
YobaDropper checks the host executable’s name before proceeding; a mismatch results in 200,000 sleep cycles of 5.5 seconds each, delaying execution beyond many analysis windows. It also filters keyboard layouts, excluding specific languages like Russian and Belarusian, while Ukrainian is specifically allowed. Administrator rights are necessary for further execution.
The dropper then copies a legitimate Windows Media Player component into a ProgramData directory and decrypts another harmful library. A scheduled task, running as Local System, launches the copied executable after a startup delay, with Microsoft-themed details masking the second sideloading stage, activating YobaLoader.
Monitoring and Detection
YobaLoader downloads a Telegram channel’s profile image, using its last 50 bytes in a domain generation algorithm, enabling operators to redirect the infection chain without altering the malware. It queries Google’s DNS-over-HTTPS for a TXT record and validates instructions with Ed25519 signatures, decrypting them using AES in ECB mode.
The loader retrieves an encrypted payload from services like Catbox. Documented XMRig mining campaigns illustrate how DNS records and image content can sustain concealed delivery chains.
Defenders should scrutinize unexpected DLL loads, Microsoft-themed scheduled tasks, and unusual directory executions. Examining full execution chains is crucial, as the observed miner is just one possible payload this loader can deliver.
