Yoba Malware Hides Behind Fake ChatGPT and Claude Apps on GitHub

Fake AI apps placed where users search

According to CPR, the attackers created GitHub repositories and GitHub Pages sites advertising supposed desktop versions of new AI products. The names used included "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus." Download links pointed to malicious ZIP files hosted as GitHub releases.

The repositories showed no evidence of artificially inflated stars or forks. They did, however, appear prominently in Google Search. Based on the search-targeted content and installer-delivery tactics, CPR assesses the campaign as consistent with SEO poisoning, meant to put malicious projects in front of people actively looking for AI software.

In CPR's framing, this turns demand for new AI capabilities into the initial attack vector, and makes software discovery itself part of the social-engineering chain.

Signed executables used for DLL sideloading

The downloaded packages combine Yoba's malicious components with legitimate software. The ChatGPT-themed packages contained a legitimate, signed OpenAI Setup.exe, while the Claude package used a legitimate, signed Claude executable. When launched, these executables load a malicious winmm.dll placed next to them, a technique known as DLL sideloading.

CPR stresses that its research does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised. The attackers instead exploit legitimate signed binaries and the credibility of the brands. For defenders, the lesson is that a valid signature can establish the legitimacy of an individual executable, but not of every component packaged alongside it.

The malicious component, YobaDropper, runs several checks meant to complicate automated analysis. It verifies that it was launched by the expected Setup.exe, introduces a lengthy delay if that check fails, applies regional language checks, and requires administrator privileges. It then deploys YobaLoader alongside a legitimate Windows executable and creates a scheduled task so that executable sideloads YobaLoader after system startup.

Telegram, Google DNS and Catbox in the delivery chain

Yoba combines several legitimate internet services to get its next stage rather than relying solely on dedicated command-and-control infrastructure. YobaLoader first accesses a Telegram channel and retrieves its profile image. Data from that image is used to generate a domain, so the attacker can change the domain by swapping the image.

The malware then queries Google's DNS-over-HTTPS service for a DNS TXT record tied to that domain. After validating and decrypting the response, it can fetch an encrypted payload from external hosting such as Catbox. CPR says this makes malicious traffic harder to tell apart from normal activity and makes blocking a single server or domain less effective.

A miner this time, but the loader is generic

In the campaign CPR analyzed, the final payload was XMRig 6.26.0, used to mine cryptocurrency. The miner could communicate through Tor and monitor user activity, pausing mining while the victim was actively using the computer.

CPR cautions against viewing Yoba simply as cryptomining malware. YobaLoader is a generic loader that can deliver other Windows executable or PowerShell payloads, so the same chain could potentially distribute other malware. Organizations that encounter Yoba should treat the infection as a broader compromise rather than focusing only on removing XMRig.

What it means for organizations

CPR argues that protecting AI adoption involves more than securing models, prompts and corporate data. It also means managing how employees discover, download and install AI applications. Its recommendations include:

• Verify software at the source: download through vendor-controlled channels rather than relying on search rankings, GitHub pages or third-party links.
• Restrict unauthorized applications and administrator privileges on corporate endpoints.
• Inspect downloads and behavior: Check Point points to Threat Emulation and browser protection in its Endpoint Security product.
• Detect activity beyond the first file: including what legitimate applications load and execute.

Check Point also says its ThreatCloud AI offers protection against command-and-control activity and machine-generated domains, which are relevant to campaigns like Yoba.