Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
Do Son 
GPT-6 Astra campaign, attack chain | Image: Check Point
TL;DR
Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.
Delivery and Attribution
Starting in July 2026, attackers created fake GitHub repositories and GitHub Pages sites promoting nonexistent desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus 5 Free. An earlier wave spotted in June 2026 also impersonated the Cursor AI coding agent. Although the repositories lacked fake stars or forks, search engine optimization pushed the landing pages to the top of Google search results. Between August 30 and September 4, 2026, the operators uploaded three unencrypted ZIP archives to GitHub Releases. According to repository telemetry, users downloaded the GPT-5.6 Sol release 269 times, the Claude Opus release 82 times, and the GPT-6 Astra package 352 times, totaling 703 downloads.
Confirmed Versus Suspected Attribution
Researchers have not linked this operation to a known threat group, so confirmed attribution does not apply. However, suspected attribution points to a Russian-speaking developer operating in the UTC-4 time zone. Although git commit logs used three different Outlook email addresses across UTC+4, UTC-4, and UTC+3 to obscure the operator’s location, compilation timestamps on the malicious DLL matched UTC-4. Furthermore, the malware uses a Russian meme channel on Telegram and skips computers configured with Russian and 10 other Commonwealth of Independent States keyboard layouts.
Infection Chain
Unlike typical GitHub malware archives that require a password, the Yoba malware campaign ships unencrypted ZIP files because its payloads evade static antivirus scanners. Each archive contains a real, digitally signed executable renamed to Setup.exe alongside a malicious winmm.dll file tracked as YobaDropper. Specifically, the ChatGPT lures abuse a signed OpenAI Codex notification helper binary, while the Claude lure abuses a signed Anthropic Claude executable.
Anti-Sandbox Checks and Persistence
When the victim launches Setup.exe, the signed binary sideloads YobaDropper into memory. All 180 exported functions in the spoofed DLL contain empty return instructions, leaving the actual code inside the main entry point. First, the dropper calculates a DJB2 hash of its host process name to verify it is running inside Setup.exe. If a sandbox runs the DLL under a different name, the malware enters a sleep loop lasting roughly 12.73 days.
Second, the dropper checks the system keyboard layout against a bitmask to exclude 11 CIS languages: Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Tatar. Notably, the code contains an explicit exception for Ukrainian (language ID 0x22) so Ukrainian machines still get infected. Next, the dropper checks for administrator privileges and prompts the user to restart with elevated rights if needed.
Once elevated, YobaDropper creates a WMProcess folder inside ProgramData and copies the legitimate Windows Media Player utility WMPDMC.exe from System32 into that folder. It then decrypts an embedded payload using the XOR key IRANNUMBERONE and drops it as wmpdui.dll, which researchers track as YobaLoader. Finally, the dropper creates a Local System scheduled task disguised as a Microsoft Corporation media metadata collector that launches WMPDMC.exe three minutes after boot.
Command-and-Control and Data-Exfiltration Behavior
When WMPDMC.exe runs, it sideloads YobaLoader. Although YobaLoader shares code with the dropper, the developer changed the DJB2 API hashing seed from 0x1505 to 0x1DEB to hinder automated analysis. To find its command server without hardcoding a domain, the GitHub Yoba malware campaign connects to a Telegram channel named yoba_fanclub and downloads the channel’s profile picture. Next, a domain generation algorithm reads the last 50 bytes of that image file to pick words from internal adjective, noun, and verb lists, creating a dynamic domain ending in .dedyn.io. As the Check Point Research report notes, “By changing the image of the Telegram channel, a new domain can be generated.”
DNS-over-HTTPS Tasking and Tor Mining
Subsequently, YobaLoader queries Google’s DNS-over-HTTPS API to retrieve a TXT record from the generated domain. It decodes the Base64 response, verifies its authenticity using an embedded Ed25519 public key, and decrypts the command with an AES-ECB key. In the analyzed wave, the decrypted command pointed to an encrypted payload hosted on the Catbox file-sharing service.
Depending on a numeric prefix in the command string, YobaLoader can inject the payload into svchost.exe, drop and run a temporary executable after stripping its Windows Zone.Identifier stream, or run a hidden PowerShell script. In observed attacks, the loader injected XMRig 6.26.0 into svchost.exe. The miner unpacks Tor 0.4.9.12 and obfs4 bridges to route mining traffic to a hidden .onion pool over TLS, uses up to 85 percent of CPU threads, loads the vulnerable WinRing0 driver for hardware register access, and pauses whenever the user moves the mouse.
Defense and Detection Guidance
Even though this wave delivered a cryptominer, YobaLoader can deploy any executable or PowerShell payload signed by the operator’s private key. As Check Point warned, “For defenders, Yoba highlights an important distinction: a valid signature can establish the legitimacy of an individual executable, but not of every component packaged alongside it.” Therefore, security teams should hunt for the WMProcess folder inside ProgramData and check for wmpdui.dll files sitting beside copies of WMPDMC.exe. Defenders should also monitor scheduled tasks for entries claiming to collect Windows Media Player metadata under the Local System account, restrict unsigned DLL loading, and direct employees to download AI software only from verified vendor domains.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
