Yoba malware hides an XMRig miner in fake AI installers
Original title: Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
Check Point Research describes Yoba, a two-month campaign that uses fake GitHub projects posing as AI desktop apps, including GPT-5.6 Sol, GPT-6 Astra and Claude Opus. ZIP releases pair a legitimate signed OpenAI or Anthropic Setup.exe with a malicious winmm.dll that sideloads YobaDropper. A scheduled task later runs YobaLoader, which derives its download site from a Telegram profile image, DNS-over-HTTPS and Catbox. The final payload is XMRig 6.26.0, which can use Tor and pause when the user is active.
Unconfirmed: Check Point infers the differing commit time zones were meant to hide the actor’s location.
- Malicious releases appeared on August 30, August 31 and September 4.
- The dropper runs only when launched as Setup.exe and skips listed CIS keyboard layouts.
- Persistence uses a Local System task that sideloads wmpdui.dll through WMPDMC.exe.
- The miner can start Tor 0.4.9.12 and lyrebird 0.8.1 and use about 85% of CPU threads.
Impact: Installs an XMRig cryptocurrency miner on Windows PCs.
- 1.Avoid GitHub installers offered as GPT-5.6 Sol, GPT-6 Astra or Claude Opus.
- 2.Treat winmm.dll or wmpdui.dll beside signed Setup.exe or WMPDMC.exe as suspicious.
- ATT&CK
- T1574.002 DLL Side-LoadingT1204.002 Malicious FileT1053.005 Scheduled TaskT1568.002 Domain Generation AlgorithmsT1496 Resource Hijacking
- Organizations
- Check Point
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aber.ir | for persistence, and excluded only Russia. They also used .aber[.]ir instead of dedyn[.]io and included anti-debugging and ant |
| domain | dedyn.io | s from word lists in the form adjective-noun-verb-number on dedyn[.]io. Change the picture and the operator gets a new domain. T |
From the original article
5 min read at securityaffairs.com
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.