Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Original title: Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
Check Point describes the Yoba campaign, which publishes fake GitHub projects posing as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus desktop apps. ZIP releases contain a real signed OpenAI or Anthropic Setup.exe plus a malicious winmm.dll that sideloads YobaDropper. The dropper skips Russian and several former Soviet keyboard languages, then schedules YobaLoader, which builds its domain from a Telegram profile image and fetches a DNS TXT command. The observed payload was an XMRig miner over Tor; Check Point says the loader could deliver other malware later.
Unconfirmed: Check Point's indicators suggesting Russian origins do not prove who operates the campaign.
- Earlier YobaDropper samples from early June 2026 used a process named Cursor.exe.
- The loader reads the last 50 bytes of a Telegram channel image to form a dedyn.io domain.
- It verifies the DNS TXT command with Ed25519 and decrypts it with AES before fetching a Catbox file.
- Commit times span UTC+4, UTC-4, and UTC+3; Check Point cites indicators suggesting Russian origins without proof.
Impact: Loader runs under a signed process and installs an XMRig miner
| Product | Affected |
|---|---|
| OpenAI signed Setup.exe used as sideload host | — |
| Anthropic signed Setup.exe used as sideload host | — |
- 1.Download ChatGPT and Claude only from openai.com or anthropic.com.
- 2.Watch for signed programs loading DLLs from user folders and Microsoft-labeled scheduled tasks.
- 3.Look for unusual DNS-over-HTTPS lookups used to retrieve loader commands.
- ATT&CK
- T1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1568 Dynamic ResolutionT1071.004 DNST1496 Resource Hijacking
- Organizations
- Check PointQiAnXinSophos
- Countries
- Russia
- AI models
- GPT-5.6 SolGPT-6 AstraClaude Opus
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adjective-noun-verb-number.dedyn.io | ild a new domain name. The domains follow a pattern such as adjective-noun-verb-number.dedyn.io. Changing the channel image creates a new domain, which mak |
From the original article
4 min read at cybersecuritynews.com
A malware campaign known as Yoba targets users by leveraging the popularity of AI tools like ChatGPT and Claude to trick them into installing infected software. They publish fake GitHub projects that pose as desktop apps named GPT-5. 6 Sol, GPT-6 Astra, and Claude Opus.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.