Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
- Mentions · 7d1
- Mentions · 30d1
- All mentions1
- First seenOct 27, 2026
- Last mentioned3d ago
Timeline
1 articles · newest firstAppears with
- Beaglemalware · 1
- YobaLoadermalware · 1
- Claudeproduct · 1
- ChatGPTproduct · 1
- Sophosorganization · 1
- Yobamalware · 1
- OpenAIvendor · 1
- Check Pointorganization · 1
- GPT-5.6 Solai model · 1
- YobaDroppermalware · 1
- XMRigmalware · 1
- Anthropicvendor · 1
- Claude Opusai model · 1
- GPT-6 Astraai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.