Hackers Exploit DLL Sideloading in OpenAI and Anthropic Binaries to Deploy YobaLoader
Original title: Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic executables to install YobaLoader and XMRig miner.
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research tracked the activity for two months. The operators pair legitimate signed OpenAI and Anthropic executables with malicious winmm.dll, causing the payload to load via DLL sideloading. The dropper hashes its host process name and demands administrator rights before deploying the miner.
- First repository dates to mid-July 2026, malicious ZIP releases in August and September 2026
- Malicious ZIPs contain genuine signed Setup.exe plus winmm.dll named YobaDropper
- YobaLoader fetches Telegram profile image and uses DoH resolver for C2 domains on dedyn[.]io
- Check Point saw mode 1 deliver XMRig 6.26.0 miner
Impact: cryptocurrency mining and potential further malware deployment
| Product | Affected |
|---|---|
| OpenAI executables | — |
| Anthropic executables | — |
- Threat actors
- Yoba
- Malware
- YobaLoaderXMRig
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aber.ir | . It persisted through a Startup-folder shortcut, used the .aber[.]ir domain suffix, and included anti-debugging and VM-scoring |
| domain | dedyn.io | jective, noun, verb and number lists, producing names under dedyn[.]io. Changing the channel photo changes the domain, so the op |
| sha256 | 2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c | okups from non-browser processes. IOCs SHA-256 Hash Malware 2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c YobaDropper e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974 |
| sha256 | 2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 | 1c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 YobaDropper 2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 YobaDropper 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a7 |
| sha256 | 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739 | f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4 YobaDropper 8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739 YobaDropper Note: IP addresses and domains are intentionall |
| sha256 | e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 | 2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c YobaDropper e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221 YobaDropper 2ebf2759195413e44f9e77cc8360976f989ff96e05531d4 |
From the original article
3 min read at gbhackers.com
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.