Fake ChatGPT and Claude apps sideload miners via YobaLoader
Original title: Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
Check Point Research describes a campaign it calls Yoba, using fake GitHub projects that pose as desktop apps such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Archives include a signed OpenAI Codex or Claude Setup.exe that sideloads winmm.dll, called YobaDropper. The chain uses a scheduled task, a Telegram image, a dictionary domain-generation algorithm and DNS-over-HTTPS, then injects XMRig into svchost.exe. Repositories appeared around July 2026; malicious releases followed in late August.
Unconfirmed: Check Point says mixed uploader time zones likely hide the operator's location; no group is named.
- YobaDropper runs only if the host name hashes to 0xE6C2F326, matching Setup.exe.
- It skips several CIS keyboard layouts and Tatar, but not Ukraine.
- YobaLoader must be launched by wmpdmc.exe before it continues.
- Control uses Telegram, dedyn.io domains and Google DNS-over-HTTPS.
- Early builds excluded only Russia and later dropped heavier anti-VM checks.
Impact: Installs an XMRig cryptocurrency miner through sideloaded DLLs
- 1.Do not install unofficial ChatGPT or Claude desktop apps from GitHub.
- 2.Look for winmm.dll placed beside a signed Setup.exe in downloaded ZIPs.
- ATT&CK
- T1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1568.002 Domain Generation AlgorithmsT1071.004 DNST1055 Process Injection
- Products
- ChatGPTClaudeOpenAI Codex
- Malware
- YobaLoaderYobaDropperXMRig
- Organizations
- Check Point Research
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | catbox.moe | to obtain the link to fetch the next-stage payload ("files.catbox[.]moe/z5zpy9.dat"). "By relying on a DoH service and common fil |
| domain | dedyn.io | is domain in the format " adjective - noun - verb - digit .dedyn[.]io." Queries Google's DNS-over-HTTPS (DoH) API to obtain a B |
| domain | gpt-6-astra.github.io | -6.github.io github[.]com/gpt-6-astra/gpt-6-astra.github.io gpt-6-astra[.]github[.]io github[.]com/opus-5-0/opus-5-0.github[.]io opus-5-0[.]g |
| domain | opus-5-0.github.io | ra[.]github[.]io github[.]com/opus-5-0/opus-5-0.github[.]io opus-5-0[.]github[.]io "Each repository uses a different email address (edward |
From the original article
3 min read at thehackernews.com
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5. 6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.