VULNpocalypse
MediumEcosystem changeActive

Yoba malware hides in fake ChatGPT and Claude apps built on signed OpenAI and Anthropic binaries

Fake ChatGPT and Claude desktop apps on GitHub sideload the Yoba malware chain through signed binaries and drop an XMRig cryptominer on Windows.

Published
Updated
Exploitation
Yes, Check Point observed the chain in the wild delivering an XMRig 6.26.0 cryptominer

What happened

Check Point Research published its findings on the Yoba campaign on October 27, after about two months of tracking, according to Infosecurity Magazine and GBHackers. Attackers built fake GitHub projects posing as AI desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Each project had a repository, a GitHub Pages landing page and a ZIP release containing the malware (Security Affairs).

Some of the repositories ranked among Google’s top results despite showing no fake stars or forks. Check Point assessed that SEO poisoning was the most likely cause. Check Point did not confirm how the rankings were manipulated (Cyber Security News). The first repository appeared around July 2026. The first malicious releases landed on August 30 and 31, with a third on September 4 (Security Affairs).

The sideloading trick. Each ZIP holds a legitimate signed OpenAI or Anthropic executable named Setup.exe next to a malicious winmm.dll. The signed program loads the DLL on its own through DLL sideloading. The attack does not require compromising OpenAI or Anthropic. A valid signature protects the signed executable, not the files beside it (Cyber Security News). The ZIPs were not password-protected, and detection rates were already low (Security Affairs).

Stage 1, YobaDropper (winmm.dll). The DLL does the following:

  • It hashes its host process name and proceeds only if the name is Setup.exe. Otherwise it sleeps 200,000 times for 5.5 seconds each, about 12.7 days, to defeat sandboxes (GBHackers).
  • It checks the keyboard layout and skips CIS countries. Ukraine is not excluded (Security Affairs).
  • It requires administrator rights.
  • It creates a WMProcess folder under ProgramData and copies the legitimate WMPDMC.exe from System32 into it.
  • It writes the second stage there as wmpdui.dll.
  • It persists through a scheduled task that claims Microsoft Corporation as author, carries a Windows Media Player description and starts three minutes after boot as Local System (Security Affairs).

Stage 2, YobaLoader (wmpdui.dll). The loader avoids dedicated command-and-control infrastructure:

  • It downloads the profile picture of the Telegram channel t[.]me/yoba_fanclub and uses the last 50 bytes of the image to seed a domain generation algorithm. The algorithm produces names under dedyn[.]io.
  • It asks Google’s DNS-over-HTTPS service for a TXT record on that domain.
  • It validates the signed reply, decrypts it and obtains a payload link, in this case on Catbox (Security Affairs, GBHackers).
  • Changing the Telegram picture changes the domain, so the operator can retarget the malware without touching the binary.

Payload. The observed payload was XMRig 6.26.0 injected into svchost.exe. It mines to an onion endpoint through a local Tor SOCKS5 proxy, pauses mining while the user is active and can load the WinRing0 driver for optimization (Security Affairs). YobaLoader is a generic loader that can run any PE executable or PowerShell payload, so later waves could deliver other malware (Infosecurity Magazine). Information theft and ransomware were not documented (Cyber Security News).

Earlier variant. An earlier variant appeared in early June 2026, posing as the Cursor coding agent. It expected Cursor.exe, persisted through a startup shortcut, excluded only Russia and used the .aber[.]ir domain suffix (Security Affairs, Infosecurity Magazine).

Attribution. Check Point sees indicators suggesting Russian origins. Security Affairs reports this as an assessment, not a confirmed attribution. The number of victims is not confirmed.

Am I affected?

You are potentially affected if a Windows user in your environment downloaded and ran a ZIP from a GitHub repository or GitHub Pages site offering a desktop app named GPT-5.6 Sol, GPT-6 Astra, Claude Opus or a Cursor lookalike. Check Point’s report says the downloads came from unverified repositories found through search results. The exact repository names and URLs are not confirmed in the sources.

Look for these indicators, drawn from the sources:

  • A ZIP or folder holding a signed Setup.exe next to a winmm.dll that was compiled the same day it was added to the archive (Security Affairs).
  • A C:\ProgramData\WMProcess folder holding a copy of WMPDMC.exe and wmpdui.dll. WMPDMC.exe should not be running outside System32 (GBHackers).
  • A scheduled task running as Local System with Microsoft Corporation as author and a Windows Media Player device metadata description, starting three minutes after boot.
  • Telegram traffic, or DNS-over-HTTPS lookups for dedyn[.]io through dns.google, from non-browser processes.
  • Unexplained high CPU use, and svchost.exe with Tor-related activity (Security Affairs).
  • Any of these YobaDropper SHA-256 hashes, reported by both GBHackers and Cyber Security News:
  • 2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c
  • e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221
  • 2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4
  • 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739

Cyber Security News lists additional YobaDropper and YobaLoader hashes.

No CVE is involved and no patch applies. OpenAI and Anthropic software is not vulnerable here. Their signed executables are only being abused.

What to do now

  1. Search endpoint telemetry and file systems for the indicators above: the WMProcess folder, WMPDMC.exe outside System32, Microsoft-themed Local System tasks, and the listed hashes.
  2. Hunt in network logs for Telegram access and DNS-over-HTTPS lookups for dedyn[.]io from non-browser processes (GBHackers).
  3. Isolate any host that matches and remediate it under your incident response process. Because YobaLoader can run arbitrary executables or PowerShell, treat the miner as only one possible payload (Infosecurity Magazine). Whether other payloads were delivered is not confirmed.
  4. Do not trust a valid signature on its own. Alert on unexpected DLLs, such as winmm.dll, sitting next to a signed executable (GBHackers).
  5. Block or restrict execution of software from unknown sources, and tell users to install AI applications only from verified vendor channels, not from repositories found through search (Infosecurity Magazine).
  6. Watch for new variants. The earlier Cursor lookalike used different file names and a .aber[.]ir domain suffix, and the Telegram channel stayed constant across versions (GBHackers).

Sources