Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Original title: Tricks from the Past deployed via signed ChatGPT and Claude binaries
Check Point says the chain uses signed OpenAI and Anthropic binaries plus Telegram, Tor, Catbox and DNS over HTTPS.
Check Point Research describes a campaign it tracks as Yoba that lures users to fake GitHub projects posing as desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Installers place malware beside legitimate signed OpenAI and Anthropic executables so a dropper can load through DLL sideloading. YobaDropper carries YobaLoader, which fetches a final payload using Telegram, Tor, Catbox and DNS over HTTPS instead of dedicated command servers. Check Point says timezone clues and other indicators suggest Russian origins.
Unconfirmed: Check Point says indicators suggest Russian origins, but that is not confirmed attribution.
- Repositories used distinct Outlook addresses and commit offsets of UTC+4, UTC-4 and UTC+3.
- The first repository dates to July 16, 2026; malicious ZIP releases began August 30.
- Named releases include sol-setup.zip, Setup-Claude.zip and GPT-6-Astra-Setup.zip.
- The ZIPs were not password-protected; Check Point cites low detection from anti-analysis techniques.
Impact: Unwanted software runs after fake AI desktop installers are opened
- 1.Do not install ChatGPT or Claude desktop apps from unofficial GitHub releases.
- 2.Treat projects named GPT-5.6 Sol, GPT-6 Astra or Claude Opus as malicious.
- Malware
- YobaYobaDropperYobaLoader
- Organizations
- Check Point Research
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad.onion | or MSR-based mining optimization. Field Value Mining server 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 Pool password/token dcde1f56048fa18657dc4820397592f7 |
| domain | catbox.moe | d53f3a6322cf40e84e63db . Decrypted response: 1https://files.catbox[.]moe/z5zpy9.dat The downloader retrieves the encrypted payload |
| domain | dedyn.io | in has the following format, "$adjective-$noun-$verb-$digit.dedyn[.]io" . By changing the image of the Telegram channel, a new d |
| domain | dns.google | mand from a DNS TXT record, using a URL of the form https://dns[.]google/resolve?name=$DGA&type=TXT . By relying on a DoH service |
| ipv4 | 51.89.228.250 | 77OX4MzoYIRz3qx4q7yHL5bRN60Gg iat-mode=0 Tor bridge 2 obfs4 51.89.228[.]250:21668 BA8BD67D8898CF378D4F73821DEB5657F4BB98DF cert=bEpLL |
| ipv4 | 51.89.231.85 | Tor data directory %TEMP%\torbundle\data Tor bridge 1 obfs4 51.89.231[.]85:24526 A44162645CEAA39C7106C49A3F36FD99FF8D8A00 cert=cVNRB |
| md5 | 1d0d1368b4d53f3a6322cf40e84e63db | crypts the decoded value using AES in ECB mode with the key 1d0d1368b4d53f3a6322cf40e84e63db . Decrypted response: 1https://files.catbox[.]moe/z5zpy9.da |
| md5 | dcde1f56048fa18657dc4820397592f7 | hvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 Pool password/token dcde1f56048fa18657dc4820397592f7 TLS Enabled ( --tls ) Proxy socks5://127.0.0[.]1:9550 Donat |
| sha1 | 028bfd4c1041dc1f030c9480a463366e6089e661 | =========== [2026-09-04T22:56:13Z] Author: gpt-6-astra tree 028bfd4c1041dc1f030c9480a463366e6089e661 author gpt-6-astra < [email protected] > 1788562573 +0300 c |
| sha1 | 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4 | =============== [2026-07-16T14:44:31Z] Author: gpt-5-6 tree 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4 author gpt-5-6 < [email protected] > 1784213071 +0400 commi |
| sha1 | 46ae1f147cf70d4df1471f0e9df46b654d11fe9c | ============== [2026-08-31T21:33:26Z] Author: opus-5-0 tree 46ae1f147cf70d4df1471f0e9df46b654d11fe9c author opus-5-0 < [email protected] > 1788212006 -0400 comm |
| sha1 | a44162645ceaa39c7106c49a3f36fd99ff8d8a00 | EMP%\torbundle\data Tor bridge 1 obfs4 51.89.231[.]85:24526 A44162645CEAA39C7106C49A3F36FD99FF8D8A00 cert=cVNRBh1enpvEGxA0ouu568EDFhWPl9taldydYgiJk77OX4MzoYIRz3 |
| sha1 | aebceccb0f3303806c35a73da865b684594487c1 | =============== [2026-07-16T14:39:40Z] Author: gpt-5-6 tree aebceccb0f3303806c35a73da865b684594487c1 author gpt-5-6 < [email protected] > 1784212780 +0400 commi |
| sha1 | ba8bd67d8898cf378d4f73821deb5657f4bb98df | bRN60Gg iat-mode=0 Tor bridge 2 obfs4 51.89.228[.]250:21668 BA8BD67D8898CF378D4F73821DEB5657F4BB98DF cert=bEpLLgOwJ9fOJbeHb5r+ronUF2ck5nRd0Jl3zuy7rLoUp732QK2p/C |
| sha256 | b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64 | it using Ed25519 signature verification with the public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64 . Once the signature validation succeeds, it decrypts the d |
From the original article
12 min read at research.checkpoint.com
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5. 6 Sol, GPT-6 Astra, and Claude […]
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.