Yoba Campaign Abuses Fake AI Apps and Signed Binaries to Deliver XMRig
Summary
Check Point Research details Yoba, a campaign using fake ChatGPT and Claude GitHub apps and signed binaries for DLL sideloading. Its loader uses Telegram-seeded domain generation and DNS-over-HTTPS to fetch payloads, including an XMRig miner.
Key points
- The researchers found fake GitHub projects posing as ChatGPT and Claude desktop apps, with search-targeted pages directing users to malicious ZIP releases.
- The releases bundle a malicious DLL beside legitimate signed OpenAI or Anthropic executables, which sideload it when run.
- YobaDropper checks for administrator privileges, installs files under ProgramData, and uses a scheduled task to maintain persistence.
- YobaLoader derives changing domains from a Telegram channel’s profile image, then uses DNS-over-HTTPS TXT records to obtain tasking and a payload.
- The observed final payload is an XMRig cryptocurrency miner; the researchers say the loader can also deliver other PE or PowerShell payloads.
- Check Point recommends avoiding AI helper downloads from unverified repositories and restricting execution of software from unknown sources.
Article Details
- Attack Vectors
- Fake GitHub repositories and GitHub Pages impersonated ChatGPT and Claude desktop applications and distributed malicious ZIP releases; the pages used search-targeted content consistent with SEO poisoning.
- The installers placed malicious DLLs beside legitimate signed OpenAI or Anthropic executables for DLL sideloading. YobaDropper then deployed YobaLoader and configured scheduled-task persistence.
- YobaLoader retrieved a Telegram channel profile image, used it to derive a DGA domain, and queried Google DNS-over-HTTPS for a TXT record containing encrypted tasking. It then downloaded an encrypted payload from Catbox.
- The loader could inject the downloaded payload into svchost.exe, save and execute an EXE, or save and run a hidden PowerShell script. The observed final payload was an XMRig miner routed through Tor.
- Defensive Notes
- Avoid installing AI helpers or similar software from unverified repositories.
- Enforce policies that restrict running software from unknown sources, and combine user awareness with technical controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | calm-piano-floats-313[.]dedyn[.]io | DGA-generated domain queried by the loader for TXT-record command data. |
| HOSTNAME | gpt-5-6[.]github[.]io | Attacker-created GitHub Pages host used to promote a malicious release. |
| HOSTNAME | gpt-6-astra[.]github[.]io | Attacker-created GitHub Pages host used to promote a malicious release. |
| HOSTNAME | opus-5-0[.]github[.]io | Attacker-created GitHub Pages host used to promote a malicious release. |
| SHA1 | 17e8639a00bb32b10cb9cf0d292e9441456ce4bb | YobaDropper sample hash. |
| SHA1 | 20238b36645fc63139a76b19a480c6a9166472fa | YobaDropper sample hash. |
| SHA1 | 22661f4bada8167fa0f410b75e53184998990abb | YobaLoader sample hash. |
| SHA1 | 2ecb5548e9774a3d05e8669e8414dcc366929b79 | YobaLoader sample hash. |
| SHA1 | 332e3b685e375aa44a5ec98511fc53be821df46a | Hash listed for a malicious ZIP release. |
| SHA1 | 3fef1af3664429e621d3e0f9408cb5102ef02b84 | YobaLoader sample hash. |
| SHA1 | 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 | YobaDropper sample hash. |
| SHA1 | 55043ea6d102670c014e2be5a8197e70b7c201cb | YobaLoader sample hash. |
| SHA1 | 60aece343959a2e1840f6aaeffa38b73ed21af2c | YobaDropper sample hash. |
| SHA1 | 7467b6980440ec27c4e0a8d940672c9f24e14216 | Hash listed for the encrypted downloaded payload. |
| SHA1 | 79e87a6df59d68b2dbd2c43950df5663d671007c | YobaLoader sample hash. |
| SHA1 | 7dfcee02732ed89f1ddf25d1689863c26de3df15 | YobaLoader sample hash. |
| SHA1 | 8777db31d8df78f36e4544a132d843dfb2a0f026 | YobaDropper sample hash. |
| SHA1 | bead5748d813a9828ddb7603a32e52aa15349768 | YobaLoader sample hash. |
| SHA1 | c2b986704406d47dd88ee4e2fcffebc854ff2ce4 | Hash listed for a malicious ZIP release. |
| SHA1 | cf90c4599257e76984a199d98b1fd082b820a54d | YobaLoader sample hash. |
| SHA1 | e7c0e981f81447892995d01ed986c0b462a6f0c5 | Hash of the Telegram channel image used by the malware as its DGA seed. |
| SHA1 | ea16728f6928dc77deaddee74a6e736dd5f24fc5 | Hash listed for the XMRig miner payload. |
| SHA1 | eeedc5c9007d7f01808285e0ae0c0b451bdba003 | YobaLoader sample hash. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper uses XOR-encrypted strings and payloads; the loader also decrypts its configuration and downloaded payload.T1036.004 · Masquerade Task or ServiceThe scheduled task was given a Microsoft Corporation author and a Windows Media Player-like description to appear legitimate.T1053.005 · Scheduled TaskYobaDropper created a scheduled task to launch a copied legitimate host at startup after a three-minute delay.T1055 · Process InjectionOne loader deployment method injects the downloaded payload into svchost.exe using NtWriteVirtualMemory and NtCreateThreadEx.T1059.001 · PowerShellOne deployment method saves the payload as a PowerShell script and runs it with a hidden window and ExecutionPolicy Bypass.T1071.004 · DNSThe malware queries a DGA domain's DNS TXT record through Google DoH to obtain encrypted command data.T1102.001 · Dead Drop ResolverThe loader retrieves a Telegram channel profile image that serves as the seed for generating its next domain.T1105 · Ingress Tool TransferThe loader downloads an encrypted payload from the specific Catbox resource identified in the article.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypts embedded strings and payloads, including the downloaded payload, before using them.T1204.002 · Malicious FileThe campaign lures victims to download and run fake AI desktop application installers.T1496 · Resource HijackingThe final observed payload is an XMRig cryptominer that uses the infected system for mining.T1497.001 · System ChecksThe malware checks its host executable name and, in an earlier version, performed hardware and hypervisor checks to detect analysis environments.T1497.003 · Time Based ChecksAfter a failed host-name check, the DLL performs 200,000 Sleep(5500) iterations, delaying execution for about 12.73 days.T1547.001 · Registry Run Keys / Startup FolderAn earlier Yoba version created a shortcut in the Startup folder to launch a copied executable that sideloaded the loader.T1574.002 · DLL Side-LoadingThe malware DLL was placed beside legitimate signed OpenAI or Anthropic executables and loaded through DLL sideloading.
People
Malware
XMRigFinally, the injected payload into svchost.exe is an XMRig 6.26.0 miner with a hidden command line targeting a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy.YobaDropperInside the installers, there is a malicious component we refer to as the YobaDropper.YobaLoaderThis dropper includes another component, the YobaLoader, which is responsible for contacting attacker-controlled infrastructure and fetching the final payload.
Vendors
AnthropicThe malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections.CatboxThis campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS (DoH).GitHubtrack as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.GoogleWhile the repositories do not show signs of fake engagement (such as artificially inflated stars or forks) that would promote them within GitHub’s own search, they still appear among the top results on Google.OpenAIThe malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections.TelegramThis campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS (DoH).
Products
ChatGPTTricks from the Past deployed via signed ChatGPT and Claude binariesClaudeTricks from the Past deployed via signed ChatGPT and Claude binariesCursor AI Coding Agent0x56221573 Cursor.exe Cursor AI Coding AgentGitHubtrack as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.Windows Media PlayerTo make the task appear legitimate, it sets the author to Microsoft Corporation and the description to Collects device metadata for Windows Media Player..
Tools
lyrebirdIt can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization.PowerShellSaves the payload as a %TEMP%\$10_rand_char\$10_rand_char.ps1 PowerShell script and invokes it with the following parameters: -WindowStyle Hidden -ExecutionPolicy Bypass -File.TorThis campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS (DoH).YARAYara Rules