Skip to content
NewA calmer, faster ZeroHour
Malwarehigh

Fake ChatGPT and Claude GitHub apps sideload Yoba malware

Original title: Hackers Use Signed ChatGPT and Claude Binaries to Deploy Yoba Malware

GBHackersby Divya ()3 min read
Read at gbhackers.com
Part of a story covered by 9 sourcesFake ChatGPT and Claude apps sideload Yoba malware via signed binariesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.

Check Point Research says fraudulent GitHub projects advertised non-existent desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus and delivered ZIP files via SEO-poisoned pages. OpenAI, Anthropic, ChatGPT and Claude were not compromised. Victims running Setup.exe load a malicious winmm.dll, YobaDropper, which drops YobaLoader beside a copied Windows Media Player binary and persists as a Local System scheduled task. Commands arrive through a Telegram image, a generated domain and DNS-over-HTTPS TXT records. An observed payload was XMRig 6.26.0; the loader can also run arbitrary PE or PowerShell payloads.

Unconfirmed: XMRig was observed, but Check Point says YobaLoader can deliver other PE or PowerShell payloads.

Key facts
  • YobaDropper skips systems whose keyboard languages match a listed set and excludes Ukrainian.
  • The scheduled task is described as collecting metadata for Windows Media Player and runs three minutes after boot.
  • Commands are Ed25519-verified and AES-ECB decrypted before PE injection, EXE execution or hidden PowerShell.
  • June 2026 variants targeted Cursor.exe and used .aber.ir domains.
Security assessment · AI, from the article

Impact: Arbitrary code execution and cryptomining on developer machines

What to do
  1. 1.Restrict unapproved AI software downloads from unofficial GitHub projects.
  2. 2.Alert on signed processes loading DLLs from writable directories and inspect suspicious scheduled tasks.
  3. 3.Monitor Telegram, Catbox, Tor, dynamic DNS and unusual DNS-over-HTTPS TXT queries.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1496 Resource Hijacking
Tags
yobadll-sideloadingxmriggithubseo-poisoningchatgpt
Vendors
OpenAIAnthropic
Products
ChatGPTClaudeWindows Media Player
Malware
YobaYobaDropperYobaLoaderXMRig
Organizations
Check Point Research

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domain3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad.onion16728f6928dc77deaddee74a6e736dd5f24fc5 Mining/Tor endpoints 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 ; 51.89.228[.]250:21668 ; 51.89.231[.]85:24526 Note:
domainaber.iraintained persistence through a Startup shortcut, utilized .aber[.]ir DGA domains, and incorporated checks for DebugObject, CPU
domaincatbox.moecalm-piano-floats-313.dedyn[.]io&type=TXT Payload URL files.catbox[.]moe/z5zpy9.dat Encrypted payload SHA-1 7467b6980440ec27c4e0a8
domaindedyn.ioverb, and number for a domain such as calm-piano-floats-313.dedyn[.]io. It then queries the domain’s TXT record through Google D
domaindns.googlemage SHA-1 e7c0e981f81447892995d01ed986c0b462a6f0c5 DoH/DGA dns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXT Pa
domaingpt-6-astra.github.ioithub.io ; github[.]com/gpt-6-astra/gpt-6-astra.github.io ; gpt-6-astra[.]github[.]io ; opus-5-0[.]github[.]io ; github[.]com/opus-5-0/opus-5
domainopus-5-0.github.io6-astra/gpt-6-astra.github.io ; gpt-6-astra[.]github[.]io ; opus-5-0[.]github[.]io ; github[.]com/opus-5-0/opus-5-0.github[.]io ZIP SHA-1
ipv451.89.228.2504muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 ; 51.89.228[.]250:21668 ; 51.89.231[.]85:24526 Note: IP addresses and domai
ipv451.89.231.856bfrk2arawlvb7k7ovxad[.]onion:443 ; 51.89.228[.]250:21668 ; 51.89.231[.]85:24526 Note: IP addresses and domains are intentionally de
md51d0d1368b4d53f3a6322cf40e84e63dbsubsequently decrypts the commands using an AES-ECB key of 1d0d1368b4d53f3a6322cf40e84e63db. A command prefix selects one of three execution paths: it
sha1163c81187d8024123912c3c12d905fd5210afcb32b986704406d47dd88ee4e2fcffebc854ff2ce4 Signed binary SHA-1 163c81187d8024123912c3c12d905fd5210afcb3 ; 65a3ac8f341ae04982005fd2c4e83627a68793a3 YobaDropper SHA-
sha117e8639a00bb32b10cb9cf0d292e9441456ce4bb65a3ac8f341ae04982005fd2c4e83627a68793a3 YobaDropper SHA-1 17e8639a00bb32b10cb9cf0d292e9441456ce4bb ; 20238b36645fc63139a76b19a480c6a9166472fa ; 4ea5b71202b69f
sha120238b36645fc63139a76b19a480c6a9166472faobaDropper SHA-1 17e8639a00bb32b10cb9cf0d292e9441456ce4bb ; 20238b36645fc63139a76b19a480c6a9166472fa ; 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 ; 60aece343959a2
sha122661f4bada8167fa0f410b75e53184998990abb; 8777db31d8df78f36e4544a132d843dfb2a0f026 YobaLoader SHA-1 22661f4bada8167fa0f410b75e53184998990abb ; 2ecb5548e9774a3d05e8669e8414dcc366929b79 ; 3fef1af3664429
sha12ecb5548e9774a3d05e8669e8414dcc366929b79YobaLoader SHA-1 22661f4bada8167fa0f410b75e53184998990abb ; 2ecb5548e9774a3d05e8669e8414dcc366929b79 ; 3fef1af3664429e621d3e0f9408cb5102ef02b84 ; 55043ea6d10267
sha1332e3b685e375aa44a5ec98511fc53be821df46a.]io ; github[.]com/opus-5-0/opus-5-0.github[.]io ZIP SHA-1 332e3b685e375aa44a5ec98511fc53be821df46a ; c2b986704406d47dd88ee4e2fcffebc854ff2ce4 Signed binary SH
sha13fef1af3664429e621d3e0f9408cb5102ef02b8453184998990abb ; 2ecb5548e9774a3d05e8669e8414dcc366929b79 ; 3fef1af3664429e621d3e0f9408cb5102ef02b84 ; 55043ea6d102670c014e2be5a8197e70b7c201cb ; 79e87a6df59d68
sha14ea5b71202b69fc27b06ef9ee3f6f51d6f7b85862e9441456ce4bb ; 20238b36645fc63139a76b19a480c6a9166472fa ; 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 ; 60aece343959a2e1840f6aaeffa38b73ed21af2c ; 8777db31d8df78
sha155043ea6d102670c014e2be5a8197e70b7c201cb14dcc366929b79 ; 3fef1af3664429e621d3e0f9408cb5102ef02b84 ; 55043ea6d102670c014e2be5a8197e70b7c201cb ; 79e87a6df59d68b2dbd2c43950df5663d671007c ; 7dfcee02732ed8
sha160aece343959a2e1840f6aaeffa38b73ed21af2c80c6a9166472fa ; 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 ; 60aece343959a2e1840f6aaeffa38b73ed21af2c ; 8777db31d8df78f36e4544a132d843dfb2a0f026 YobaLoader SHA-1
sha165a3ac8f341ae04982005fd2c4e83627a68793a3ned binary SHA-1 163c81187d8024123912c3c12d905fd5210afcb3 ; 65a3ac8f341ae04982005fd2c4e83627a68793a3 YobaDropper SHA-1 17e8639a00bb32b10cb9cf0d292e9441456ce4bb
sha17467b6980440ec27c4e0a8d940672c9f24e14216d URL files.catbox[.]moe/z5zpy9.dat Encrypted payload SHA-1 7467b6980440ec27c4e0a8d940672c9f24e14216 XMRig SHA-1 ea16728f6928dc77deaddee74a6e736dd5f24fc5 Mining
sha179e87a6df59d68b2dbd2c43950df5663d671007c8cb5102ef02b84 ; 55043ea6d102670c014e2be5a8197e70b7c201cb ; 79e87a6df59d68b2dbd2c43950df5663d671007c ; 7dfcee02732ed89f1ddf25d1689863c26de3df15 ; bead5748d813a9
sha17dfcee02732ed89f1ddf25d1689863c26de3df15197e70b7c201cb ; 79e87a6df59d68b2dbd2c43950df5663d671007c ; 7dfcee02732ed89f1ddf25d1689863c26de3df15 ; bead5748d813a9828ddb7603a32e52aa15349768 ; cf90c4599257e7
sha18777db31d8df78f36e4544a132d843dfb2a0f026f6f51d6f7b8586 ; 60aece343959a2e1840f6aaeffa38b73ed21af2c ; 8777db31d8df78f36e4544a132d843dfb2a0f026 YobaLoader SHA-1 22661f4bada8167fa0f410b75e53184998990abb ;
sha1bead5748d813a9828ddb7603a32e52aa15349768df5663d671007c ; 7dfcee02732ed89f1ddf25d1689863c26de3df15 ; bead5748d813a9828ddb7603a32e52aa15349768 ; cf90c4599257e76984a199d98b1fd082b820a54d ; eeedc5c9007d7f
sha1c2b986704406d47dd88ee4e2fcffebc854ff2ce4b[.]io ZIP SHA-1 332e3b685e375aa44a5ec98511fc53be821df46a ; c2b986704406d47dd88ee4e2fcffebc854ff2ce4 Signed binary SHA-1 163c81187d8024123912c3c12d905fd5210afcb
sha1cf90c4599257e76984a199d98b1fd082b820a54d9863c26de3df15 ; bead5748d813a9828ddb7603a32e52aa15349768 ; cf90c4599257e76984a199d98b1fd082b820a54d ; eeedc5c9007d7f01808285e0ae0c0b451bdba003 Telegram t[.]me/
sha1e7c0e981f81447892995d01ed986c0b462a6f0c5ae0c0b451bdba003 Telegram t[.]me/yoba_fanclub ; image SHA-1 e7c0e981f81447892995d01ed986c0b462a6f0c5 DoH/DGA dns[.]google/resolve?name=calm-piano-floats-313.ded
sha1ea16728f6928dc77deaddee74a6e736dd5f24fc5SHA-1 7467b6980440ec27c4e0a8d940672c9f24e14216 XMRig SHA-1 ea16728f6928dc77deaddee74a6e736dd5f24fc5 Mining/Tor endpoints 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bf
sha1eeedc5c9007d7f01808285e0ae0c0b451bdba0032e52aa15349768 ; cf90c4599257e76984a199d98b1fd082b820a54d ; eeedc5c9007d7f01808285e0ae0c0b451bdba003 Telegram t[.]me/yoba_fanclub ; image SHA-1 e7c0e981f8144789
sha256b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64esponse, verifies an Ed25519 signature using the public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64, and subsequently decrypts the commands using an AES-ECB ke

From the original article

3 min read at gbhackers.com

Hackers are exploiting growing interest in AI tools to spread Yoba malware through fraudulent GitHub projects that claim to offer non-existent desktop applications named GPT-5. 6 Sol, GPT-6 Astra, and Claude Opus. According to Check Point Research, these repositories and GitHub Pages attracted users through apparent SEO poisoning, with download buttons that delivered malicious ZIP files.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.