🚨 Yoba Malware: Fake ChatGPT and Claude Installers Abuse Signed Binaries to Deploy a Cryptominer

Check Point Research disclosed the Yoba campaign on 27 October 2026. Operators promoted fake desktop applications impersonating ChatGPT and Claude through GitHub repositories and GitHub Pages. Malicious ZIP packages included legitimate, digitally signed OpenAI or Anthropic executables alongside a malicious DLL. When the trusted executable ran, it loaded the adjacent DLL through DLL sideloading. The first stage is YobaDropper and the second is YobaLoader. The observed final payload was XMRig 6.26.0, a cryptocurrency miner. YobaLoader is a generic loader capable of delivering other Windows PE or PowerShell payloads. The research does not indicate that OpenAI, Anthropic, ChatGPT or Claude infrastructure was compromised.

• Initial access requires a user to search, download and execute the fake installer; this is not zero-click.
• Fake AI desktop projects use GitHub hosting and SEO visibility to appear credible.
• Legitimate signed executables are abused as hosts for malicious adjacent DLLs; a signature does not validate the whole package.
• YobaDropper performs anti-analysis and regional checks, requires administrator privileges, stages YobaLoader and creates scheduled-task persistence.
• YobaLoader retrieves tasking through Telegram, a generated domain, Google DNS-over-HTTPS TXT records and encrypted payload hosting on Catbox.
• The observed payload mines cryptocurrency using XMRig and Tor; future tasking could deliver other payloads.

CPR observed projects impersonating “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.” GitHub Pages described the purported products and directed users to malicious ZIP releases hosted on GitHub. CPR found no evidence of artificially inflated stars or forks; instead, projects appeared prominently in Google results, consistent with SEO poisoning. The lure exploits demand for new AI capabilities. A victim must actively search, download and run the fake installer.

Packages include a legitimate signed OpenAI Setup.exe or Claude executable plus a malicious winmm.dll. When launched from the package directory, the legitimate executable loads the adjacent malicious DLL. The signature authenticates that executable, not every file beside it. This is abuse of trusted binaries, not evidence that OpenAI or Anthropic distributed malware. CPR reports that the malicious DLL imitates winmm.dll exports; most of its 180 exports are stripped to return instructions and NOPs, while DllEntryPoint contains active logic.

YobaDropper hashes the host executable name with DJB2 and expects Setup.exe. If the expected host check fails, it can perform 200,000 Sleep(5500) iterations—about 12.73 days—to frustrate automated analysis.

It checks Windows keyboard layout and excludes selected CIS-region language IDs, with an explicit Ukrainian exception. This is a malware targeting filter, not reliable attribution.

It requires administrator privileges and exits with a prompt if not elevated.

It creates C:\ProgramData\WMProcess, copies WMPDMC.exe from System32, decrypts an embedded second stage using XOR, and writes wmpdui.dll.

A scheduled task runs the copied legitimate host at startup after a three-minute delay, under Local System, with Microsoft-like author and description fields.

YobaLoader accesses Telegram channel t[.]me/yoba_fanclub, downloads its profile image and uses the final 50 bytes as a seed for a domain-generation algorithm. The generated domain follows an adjective-noun-verb-number pattern under dedyn[.]io. It queries Google DNS-over-HTTPS for a TXT record, decodes Base64 data, validates an Ed25519 signature and decrypts tasking using AES. The tasking points to an encrypted payload hosted on Catbox. This distributed use of legitimate services complicates reputation-only blocking, but the sequence can be detected through endpoint and network telemetry.

CPR observed XMRig 6.26.0 as the final payload. It is injected into svchost.exe and connects to a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy. The sample can bundle Tor, use high CPU thread allocation and monitor user input, pausing mining while the victim is active and resuming after inactivity. The demonstrated objective is unauthorized cryptocurrency mining and resource theft. The loader can also deploy a PE executable or PowerShell script, so future variants could carry different payloads; do not claim those other actions were observed in this sample.

CPR does not name a threat group or individual. It reports indicators suggestive of Russian origins and an apparent UTC-4 operating pattern, but uploader time-zone metadata is inconsistent across repositories and may be manipulated. The defensible attribution is an unattributed operator/campaign tracked as Yoba.

• Early June 2026: earlier YobaDropper variant observed, associated with a fake Cursor AI application and Startup-folder shortcut persistence.
• 16 July 2026: initial commit recorded for the GPT-5.6 repository.
• 30 August 2026: ChatGPT-themed malicious ZIP release uploaded to GitHub.
• 31 August 2026: Claude-themed malicious ZIP release uploaded.
• 4 September 2026: GPT-6 Astra-themed malicious ZIP release uploaded.
• 27 October 2026: Check Point Research publicly disclosed Yoba technical analysis.

Yoba reuses established techniques: SEO poisoning, brand impersonation, DLL sideloading, anti-analysis, scheduled-task persistence, process injection and abuse of legitimate online services for staging. The June 2026 Cursor-themed variant shows the lure evolved to ChatGPT/Claude-themed software. CPR also notes changes in unpacking and persistence between earlier and newer variants.

• Search for unofficial AI desktop application pages and suspicious GitHub releases.
• Monitor signed Setup.exe or Claude executables loading unexpected winmm.dll files from download or writable directories.
• Alert on scheduled tasks that run copied system binaries from ProgramData, especially as Local System.
• Hunt for C:\ProgramData\WMProcess, wmpdui.dll and copied WMPDMC.exe.
• Correlate Telegram profile-image retrieval, Google DoH TXT lookups, generated dedyn[.]io domains, Catbox downloads and Tor/SOCKS traffic.
• Detect unexpected process injection, XMRig, sustained high CPU and mining endpoint connections.

• Install AI software only from the vendor’s official website or explicitly verified distribution channel.
• Do not trust a package solely because one executable inside it has a valid digital signature.
• Use application control and restrict execution from Downloads, temporary folders and user-writable paths.
• Monitor DLL load paths, scheduled-task creation, ProgramData staging and unusual process ancestry.
• If suspected, isolate the endpoint, preserve memory and disk evidence, collect process trees, loaded modules, tasks and network telemetry.
• Determine whether the payload is XMRig or another PE/PowerShell payload; do not assume cryptomining is the only possible outcome.
• Rebuild confirmed compromised systems from trusted media and rotate credentials from a clean device.

Yoba demonstrates how software trust can be weaponized without compromising the software vendor. A user searching for an AI desktop client can be directed to a fake project, download a package containing a genuine signed host executable and unknowingly load a malicious DLL. The staged loader, scheduled-task persistence and multi-service tasking make it more than a simple miner. Defenders should treat software provenance, DLL loading, persistence and network behavior as one correlated detection problem.

• Check Point Research, 27 Oct 2026: https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
• Check Point Blog: https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/
• IT Pro, 30 Oct 2026: https://www.itpro.com/security/malware/hackers-are-using-github-to-push-fake-chatgpt-and-claude-apps