Hackers Abuse Signed ChatGPT and Claude Apps to Deploy Yoba Malware
Original title: Hackers Abuse Signed ChatGPT and Claude Applications to Deploy Yoba Malware and Evade Detection
Attackers distribute Yoba malware through fake signed AI application downloads using DLL sideloading on Windows systems.
Hackers created GitHub repositories for fake ChatGPT and Claude desktop applications. The signed installers load malicious YobaDropper via DLL sideloading after environmental checks. The malware copies Windows components and launches additional payloads like XMRig miners.
- Uses legitimate signed installers and sideloading
- Requires administrator privileges
- Includes environmental bypass for certain languages
- Can deploy Telegram bots or hidden payloads
Impact: Deployment of cryptocurrency miner on compromised Windows computers
- 1.Investigate unexpected DLL loads and Microsoft-themed scheduled tasks
- 2.Review execution chains and signatures
- 3.Monitor for unusual ProgramData directory activity
- Malware
- Yoba
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dedyn.io | xecutable copied Cursor.exe Earlier variant’s expected host dedyn[.]io Shared dynamic DNS service svchost.exe Observed payload i |
| sha256 | 2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c | cators of compromise (IoCs):- Component SHA-256 YobaDropper 2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c YobaDropper e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974 |
| sha256 | 2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 | 1c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 YobaDropper 2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 YobaDropper 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a7 |
| sha256 | 4d75c5461b65a2944b12414f1e5ef301fe411c1968788134d90aaaa6a50e68dd | ee1e82cfa5db91f720b757aa8fe1457e0807b1f2210b308e YobaLoader 4d75c5461b65a2944b12414f1e5ef301fe411c1968788134d90aaaa6a50e68dd Artifact Investigation context winmm.dll Initial malicious |
| sha256 | 715e3ae134195f89d8da82ec4cbe6ba1d596d756a2c207a95f75a94afcdff3a4 | 5b5789e30dab7ce74c14ffd98f9d7e8b4f9887000e6d6834 YobaLoader 715e3ae134195f89d8da82ec4cbe6ba1d596d756a2c207a95f75a94afcdff3a4 YobaLoader 7a9d66a4637ee2a1ee1e82cfa5db91f720b757aa8fe1457e |
| sha256 | 73076c366edd5b8b351f04725663d2189a92dfdc93cc34740a61a1de9bbde51e | 2d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739 YobaDropper 73076c366edd5b8b351f04725663d2189a92dfdc93cc34740a61a1de9bbde51e YobaDropper b29cbf1bdde86ab15b5789e30dab7ce74c14ffd98f9d7e8 |
| sha256 | 7a9d66a4637ee2a1ee1e82cfa5db91f720b757aa8fe1457e0807b1f2210b308e | d8da82ec4cbe6ba1d596d756a2c207a95f75a94afcdff3a4 YobaLoader 7a9d66a4637ee2a1ee1e82cfa5db91f720b757aa8fe1457e0807b1f2210b308e YobaLoader 4d75c5461b65a2944b12414f1e5ef301fe411c1968788134 |
| sha256 | 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739 | f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 YobaDropper 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739 YobaDropper 73076c366edd5b8b351f04725663d2189a92dfdc93cc347 |
| sha256 | b29cbf1bdde86ab15b5789e30dab7ce74c14ffd98f9d7e8b4f9887000e6d6834 | 51f04725663d2189a92dfdc93cc34740a61a1de9bbde51e YobaDropper b29cbf1bdde86ab15b5789e30dab7ce74c14ffd98f9d7e8b4f9887000e6d6834 YobaLoader 715e3ae134195f89d8da82ec4cbe6ba1d596d756a2c207a9 |
| sha256 | e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 | 2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c YobaDropper e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 YobaDropper 2ebf2759195413e44f9e77cc8360976f989ff96e05531d4 |
From the original article
3 min read at cybersecuritynews.com
Hackers are distributing Yoba malware through fake ChatGPT and Claude downloads, pairing legitimate, digitally signed applications with malicious libraries. The campaign uses trusted software and GitHub hosting to make dangerous installers appear credible, ultimately deploying a cryptocurrency miner on compromised Windows computers. The attack does not require compromising OpenAI or Anthropic.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.