Fake AI Apps Deliver Yoba Malware via Signed OpenAI Binaries
First merged summary.
Check Point tracks Yoba campaign using fake ChatGPT and Claude apps to sideload XMRig via legitimate signed binaries.
Check Point Research identified a two-month Yoba campaign that exploits interest in generative AI by distributing fake GitHub projects posing as GPT-5.6 Sol, GPT-6 Astra and Claude Opus desktop apps. These releases bundle genuine signed OpenAI or Anthropic Setup.exe files with malicious winmm.dll (YobaDropper), which deploys YobaLoader through DLL sideloading. The dropper evades detection by skipping certain keyboard layouts, persists via a Local System scheduled task, and fetches payloads including XMRig 6.26.0 over Tor from Telegram and DNS-over-HTTPS.
- YobaDropper skips CIS keyboard layouts except Ukraine
- Loads via signed OpenAI/Anthropic Setup.exe
- Persists as Local System scheduled task
- Fetches XMRig 6.26.0 via Telegram and DoH
- Observed releases August 30-31 and September 4 2026
- First repo mid-July 2026
Timeline
dated events in the reporting · oldest first- Aug 30, 2026Malicious ZIP releases appear on GitHub · CSO Online
- Aug 31, 2026Additional malicious releases detected · Security Affairs
- Sep 4, 2026Further malicious release identified · CSO Online
- Oct 27, 2026Check Point announces Yoba campaign · Infosecurity Magazine
What each outlet adds
beyond the shared facts- GBHackersDetails on XMRig 6.26.0, process hashing and early anti-VM checks
- CSO OnlineSpecific malicious release dates and loader fetch methods
- Infosecurity MagazineCampaign duration, Russian origins hint and June Cursor variant
- The Hacker NewsHost name hash requirements and initial CIS layout exclusions
- Security AffairsMiner Tor version, CPU thread usage and persistence via wmpdui.dll
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
- · 6d ago
CSO Online
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
- · 6d ago
Infosecurity Magazine
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
- · 5d ago
Help Net Security
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
- · 5d ago
The Hacker News
Fake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
- · 3d ago
Security Affairs
Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
- · 6h ago
Hackers Exploit DLL Sideloading in OpenAI and Anthropic Binaries to Deploy YobaLoader
Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic executables to install YobaLoader and XMRig miner.
- · 4h ago
Cyber Security News
Hackers Abuse Signed ChatGPT and Claude Apps to Deploy Yoba Malware
Attackers distribute Yoba malware through fake signed AI application downloads using DLL sideloading on Windows systems.