Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.
The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader.
“The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections,” Check Point Research said in an analysis.
To add to the project’s credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects’ popularity is not manipulated using techniques like ghost networks, signs point to the use of SEO poisoning tactics to ensure that links to them are surfaced on top of search results on Google.
Some of the identified GitHub pages links are below –
- github[.]com/gpt-5-6/sol-free-desktop
- gpt-5-6.github[.]io
- github[.]com/gpt-5-6/gpt-5-6.github.io
- github[.]com/gpt-6-astra/gpt-6-astra.github.io
- gpt-6-astra[.]github[.]io
- github[.]com/opus-5-0/opus-5-0.github[.]io
- opus-5-0[.]github[.]io
“Each repository uses a different email address (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com), and the uploader appears to operate in UTC+4, UTC-4, and UTC+3 respectively,” Check Point said. “This inconsistency likely reflects a deliberate attempt to obscure the threat actor’s true operational time zone.”
Hosted within these repositories are ZIP archives that, among other files, contain two specific components –
- Setup.exe, a legitimate signed OpenAI Codex or Claude executable
- winmm.dll, a malicious DLL that’s sideloaded by the executable
The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value “0xE6C2F326.” In other words, the check requires it to be launched under “Setup.exe,” and fails if the DLL is executed on its own inside a sandboxed environment.
Additional anti-analysis techniques and pre-checks include 200,000 iterations of “Sleep(5500),” which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan.
Another language ID excluded from the infection process is Tatar. Notably missing from the list is Ukraine, which used to be historically included in such checks.
YobaDropper, for its part, triggers a DLL sideloading chain of its own comprising “wmpdmc.exe” and “ampdui.dll,” copying the former from its “system32” folder and placing it in a new directory named “WMProcess” created under “ProgramData.”
The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as “wmpdui.dll.” It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.
The second DLL is YobaLoader. It implements the same anti-sandbox technique as YobaDropper, requiring the malware to be run only by “wmpdmc.exe” by checking the hash against a hard-coded value (“0x552751E3”). The loader is responsible for three main tasks –
- Downloads an image from a Telegram channel (“t[.]me/yoba_fanclub”).
- Uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words and an integer value in the range 0–999 using a domain generation algorithm (DGA). The end result is domain in the format “adjective–noun–verb–digit.dedyn[.]io.”
- Queries Google’s DNS-over-HTTPS (DoH) API to obtain a Base64-encoded command from a DNS TXT record by passing the constructed domain as input.
- Decrypts the response to obtain the link to fetch the next-stage payload (“files.catbox[.]moe/z5zpy9.dat”).
“By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity,” Check Point said.
The downloaded payload is then injected into “svchost.exe,” resulting in the execution of an XMRig cryptocurrency miner.
Evidence indicates that the first GitHub repository was created around July 2026, although the malicious releases were not uploaded until the end of August. What’s more, early versions of YobaLoader have been found to only exclude Russia from infection, while also incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.
“The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance,” Check Point said. “By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious.”
