The Yoba malware campaign uses fake GitHub projects that pose as ChatGPT and Claude desktop apps to install a cryptominer, according to a Check Point Research report published October 27. The unusual part is that the installers inside the downloads are real, signed files. The harm comes from a malicious DLL packaged beside them.
How the Yoba malware reaches victims
Check Point says the attackers built GitHub repositories and GitHub Pages sites with lure names such as “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.” The download links pointed to ZIP files hosted as GitHub releases. Check Point reports that the projects ranked prominently in Google Search and assesses the campaign as consistent with SEO poisoning. It found no sign of artificially inflated stars or forks, so the pages did not look popular in the usual way.
Check Point also says it found no evidence that OpenAI, Anthropic, ChatGPT or Claude were compromised. The Yoba malware operators borrowed the real apps’ names and files, not their infrastructure.
Why a valid signature did not help
The ChatGPT-themed packages included a legitimate, signed OpenAI Setup.exe, and the Claude package included a legitimate, signed Claude executable. Each one loads a malicious winmm.dll that sits in the same folder, a technique called DLL sideloading. A code signature vouches for the signed executable only. It says nothing about other files packaged with it, which is the gap the Yoba malware exploits.
What the infection does
Check Point describes a multi-stage chain. The first stage, which it calls YobaDropper, checks that it was launched by the expected Setup.exe and delays if not. It applies regional language checks and requires administrator privileges. It then places a second component, YobaLoader, next to a legitimate Windows executable and creates a scheduled task so that executable loads YobaLoader after startup, which keeps the infection in place after a reboot.
YobaLoader finds its command server in an unusual way, according to the report. It reads the profile image of a Telegram channel and uses data from that image to generate a domain, so changing the image changes the domain. It then queries Google’s DNS-over-HTTPS service for a DNS TXT record on that domain, decrypts the response, and downloads an encrypted payload from external hosting such as Catbox.
The final payload Check Point observed was XMRig 6.26.0, a cryptominer, which communicated over Tor and paused mining when the user was active. That pause is meant to avoid the sluggishness that would prompt someone to investigate. Check Point notes that YobaLoader is a generic loader, so a different campaign could use it to deliver other Windows executables or PowerShell payloads. The blog post does not list specific hashes, domains or repository names and points to a full technical report for those.
What users and IT teams can do
Check Point’s advice is straightforward. Get AI software only from vendor-controlled channels, not from search results, GitHub pages or third-party links. Limit which applications can run and who has administrator rights, since the first stage needs elevated privileges. Inspect what a download actually contains and how it behaves rather than trusting the main file’s signature, and watch for suspicious network activity after installation, including generated domains.
For workplaces, the risk from Yoba malware and copycats grows as AI apps spread. A company that rolls out a tool widely, as Uber did with ChatGPT Work for its 30,000 employees, creates an obvious lure for anyone searching for the installer. And organizations that restrict AI tools, such as the Swedish government offices that blocked ChatGPT and Claude in the browser, may find employees hunting for workarounds that lead to exactly this kind of download.
Editor’s take
Treat the address, not the logo, as the product. A search result that looks right and a file that is signed can both be real and still lead to a bad install. For any AI desktop app, go to the vendor’s own site by typing it, or use the official app store, and ignore model names that sound like leaks or early access. The names Check Point lists are exactly the sort of thing people search for when they want the newest model first. Check Point’s report is the only source for the Yoba malware details so far, and the findings are best read as one security vendor’s analysis.
