Yoba: fake ChatGPT and Claude apps abuse signed binaries

On 27 October Check Point Research described a campaign it calls Yoba: fake GitHub projects promote Windows desktop versions of ChatGPT and Claude, with made-up names such as “GPT-5.6 Sol”, “GPT-6 Astra” and “Claude Opus”. The downloaded package contains a genuine executable signed by OpenAI or Anthropic, alongside a malicious DLL that the executable loads at startup. According to Check Point, quoted by Help Net Security, neither the products nor the two companies were compromised: the attackers abuse legitimate binaries and the credibility of the brands.

What happened

The campaign has been tracked for about two months. According to CSO Online, citing commit data, the malicious releases were uploaded on 30 and 31 August and 4 September. An earlier variant, from early June 2026, posed as the Cursor coding agent: according to Help Net Security it was built to run under a process named Cursor.exe and used the same Telegram channel and the same image. In the observed cases the final payload is the XMRig cryptocurrency miner, but the loader can download and run any executable or PowerShell script: Check Point warns that future waves may deliver other malware families.

How victims are reached

The repositories have GitHub Pages sites and the ZIP files sit in GitHub releases. They show no inflated stars or forks, yet they rank among Google’s top results: Check Point attributes this to SEO poisoning, meaning titles, descriptions and domains optimised for external search engines. According to Help Net Security the ZIP files were not password protected, as is often done to evade automated analysis: the malware already had very low detection rates thanks to its anti-sandbox and anti-analysis techniques.

The attack chain

1. DLL side-loading: the ZIP holds a genuine OpenAI or Anthropic Setup.exe next to a file named winmm.dll (CSO Online). When run, the signed executable loads the library from its own folder: this is YobaDropper.
2. Anti-analysis checks: the dropper checks the name of its host process and, according to CSO Online, stalls for about 12 days unless it was launched by a process named Setup.exe. It skips systems with Russian and other CIS keyboard layouts; Infosecurity Magazine and Help Net Security specify that Ukrainian is not among the exclusions. It requires administrator rights before continuing.
3. Persistence: with elevated rights it creates a folder under ProgramData, copies a legitimate Windows Media Player executable into it and places a second malicious DLL beside it. It then creates a scheduled task that runs as Local System three minutes after every boot, with “Microsoft Corporation” as author and described as a Windows Media Player task.
4. YobaLoader, with no dedicated command servers: the second stage downloads the profile picture of the Telegram channel yoba_fanclub and uses part of it to generate a domain name, so the operator switches domain simply by changing the picture. It queries that domain through Google’s DNS-over-HTTPS service and gets an encrypted TXT record which, once verified and decrypted, holds a link to a file hosted on Catbox.
5. Payload: XMRig is injected into a Windows process, reaches its mining server through Tor and pauses while the user is active at the computer.

Check Point reports signs of Russian origin and, according to Help Net Security, activity concentrated in the UTC-4 time zone, with a different email address and time zone for each repository to obscure the trail. No group has been named.

MITRE ATT&CK techniques

Based on the description in the sources:

• SEO Poisoning (T1608.006) and User Execution: Malicious File (T1204.002);
• Hijack Execution Flow: DLL (T1574.001), which in ATT&CK covers side-loading;
• Time Based Evasion (T1497.003) and System Language Discovery (T1614.001);
• Scheduled Task (T1053.005) and Masquerading (T1036);
• Dead Drop Resolver (T1102.001), Domain Generation Algorithms (T1568.002) and Application Layer Protocol: DNS (T1071.004);
• Multi-hop Proxy (T1090.003), Process Injection (T1055) and Resource Hijacking (T1496).

Impact for European and Italian companies

A valid digital signature proves the authenticity of the executable, not of what it loads or of the package it ships in: controls based only on signatures or file reputation let the chain start. The network helps little too: Telegram, Google’s DNS and Catbox are legitimate services, and blocking one domain does not stop the mechanism, because the domain changes with the picture.

The greatest risk is for developer workstations and for people trying out AI tools on their own: they often have administrator rights, source code, API keys and cloud credentials. The miner is the visible damage; the loader, which runs whatever it receives, is the real problem. For NIS2 entities, asset management, control of privileged access and rules on installable software are among the risk-management measures required by Article 21.

What to do now

1. Download AI apps only from the vendors’ official websites and offer a catalogue of approved tools with short approval times: if the internal channel is slow, staff will find their own way.
2. Remove permanent administrator rights from workstations, developers’ included: without them, the dropper does not continue.
3. Extend application control to DLLs and to execution from user-writable folders, not just to signed executables.
4. Hunt for the indicators: a winmm.dll next to a Setup.exe outside system folders; a Windows Media Player executable copied into ProgramData with a DLL beside it; scheduled tasks authored by “Microsoft Corporation” that launch files in ProgramData as Local System; non-browser processes using DNS-over-HTTPS or contacting Telegram and Catbox; Tor traffic and unusual CPU usage.
5. If you find Yoba, treat it as a full compromise, as Check Point recommends, and do not stop at removing XMRig: isolate the machine, check what else was downloaded and rotate the API keys, tokens and credentials stored on the workstation.

The sources consulted do not list hashes or domains; the full text of The Hacker News article was not available for this analysis.

How ARXDOME helps

ARX Sentry collects logs and security events from computers and servers, together with the software and process inventory, and groups them into families such as suspicious executions and persistence: a new scheduled task or an executable in an unusual folder shows up in the SOC pages. With ARX Trace analysts search multiple machines for the files and activity described, while ARX Shield lets you isolate a suspicious workstation from the network and check the protection status of every machine.

Last updated: 29 October 2026