As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware.
The campaign shows how the rush to access new AI tools is creating opportunities for social engineering, even when the AI platforms themselves have not been compromised.
Key Findings
- Attackers used fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications to distribute Yoba malware.
- Legitimate, signed OpenAI and Anthropic executables were abused to sideload the malicious YobaDropper.
- The malicious projects appeared prominently in Google Search, with activity consistent with SEO-poisoning tactics.
- Yoba uses services including Telegram, Google DNS-over-HTTPS and Catbox as part of its communication and payload delivery chain.
- CPR observed XMRig as the final payload, but YobaLoader can deliver other Windows executable or PowerShell payloads.
How the Yoba Malware Campaign Targets AI Users
The attack begins where many legitimate software searches begin: online. Attackers created GitHub repositories and GitHub Pages sites advertising supposed desktop versions of new AI products, using names including “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus.” Download links directed users to malicious ZIP files hosted as GitHub releases.
The repositories did not show evidence of artificially inflated stars or forks designed to boost their visibility within GitHub. However, they appeared prominently in Google Search. Based on their search-targeted content and installer-delivery tactics, CPR assesses the campaign as consistent with SEO poisoning, designed to put malicious projects in front of users actively searching for AI software.
This approach turns demand for new AI capabilities into the initial attack vector. Rather than targeting victims directly, attackers can position malicious software where users are already searching for new tools, making software discovery itself part of the social-engineering chain. For organizations, this means managing not only how employees use AI tools, but also where they obtain them.
Figure 1 — GPT-6 Astra campaign, attack chain.
Figure 2 — GitHub repository.
How Yoba Abuses Signed OpenAI and Anthropic Binaries
Once downloaded, the package combines Yoba’s malicious components with legitimate software. In the ChatGPT-themed packages, the attackers included a legitimate, signed OpenAI Setup.exe, while the Claude package used a legitimate, signed Claude executable.
When launched, these executables load a malicious winmm.dll placed alongside them using a well-established technique known as DLL sideloading. The signed executable is therefore legitimate, but the surrounding package is not.
Importantly, CPR’s research does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised. Instead, the attackers abuse legitimate signed binaries and the credibility associated with these brands. For defenders, Yoba highlights an important distinction: a valid signature can establish the legitimacy of an individual executable, but not of every component packaged alongside it.
Figure 3 — Claude Opus GitHub[.]io page.
How YobaDropper Establishes the Infection
Yoba uses several checks designed to complicate automated analysis before deploying its second stage. YobaDropper verifies that it was launched by the expected Setup.exe, introduces a lengthy delay if this check fails, applies regional language checks, and requires administrator privileges to continue.
Once these checks are complete, YobaDropper deploys YobaLoader alongside a legitimate Windows executable and creates a scheduled task that enables the legitimate executable to sideload YobaLoader after system startup.
These behaviors show that Yoba is built to move beyond the initial download, filtering its execution environment, establishing persistence and continuing through trusted processes. As a result, detection needs to account for what legitimate applications load and execute, not only the original malicious file.
How Yoba Uses Trusted Internet Services to Retrieve Payloads
One of Yoba’s more distinctive characteristics is its approach to attacker communications. Rather than relying solely on dedicated command-and-control infrastructure, Yoba combines several legitimate internet services to retrieve the information needed for its next stage.
YobaLoader first accesses a Telegram channel and retrieves its profile image. Data from that image is then used to generate a domain, allowing the attacker to change the resulting domain by changing the Telegram image.
The malware subsequently queries Google’s DNS-over-HTTPS service for a DNS TXT record associated with that domain. After validating and decrypting the response, Yoba can retrieve an encrypted payload from external hosting infrastructure such as Catbox.
By combining legitimate internet services with dynamically generated domains, the operator reduces its dependence on traditional command-and-control infrastructure and makes malicious communications harder to distinguish from normal activity. It also makes blocking a single malicious server or domain less effective against the broader delivery mechanism.
Figure 4 — Telegram channel.
XMRig Was the Final Payload, but Yoba Can Deliver More
In the campaign analyzed by CPR, the final payload was XMRig 6.26.0, used to mine cryptocurrency. The miner could communicate with its infrastructure through Tor and monitor user activity, pausing mining while the victim was actively using the computer.
However, Yoba should not be viewed simply as cryptomining malware. YobaLoader is a generic loader capable of delivering different Windows executable or PowerShell payloads, meaning the same infection chain could potentially be used to distribute other malware.
This makes the loader more significant than the payload observed in this campaign. Organizations encountering Yoba should therefore treat the infection as a broader compromise rather than focusing solely on detecting or removing XMRig.
What Yoba Reveals About the Abuse of AI Brands
Yoba shows how attackers can exploit AI adoption without compromising an AI model or service. Instead, they target the trust and demand surrounding AI tools, combining search visibility, familiar platforms such as GitHub, recognizable AI brands and legitimate signed executables to make malicious software appear credible.
For organizations, this broadens the AI security conversation. Protecting AI adoption involves not only securing models, prompts and corporate data, but also managing how employees discover, download and install AI applications. As AI tools proliferate, verifying their origin will become an increasingly important part of reducing the social-engineering opportunities surrounding them.
How Organizations Can Reduce the Risk of Fake AI Tools
Organizations can reduce their exposure by combining tighter software controls with security that examines what files and applications actually do. This is particularly relevant as employees increasingly discover and adopt AI tools independently.
- Verify AI software at the source. Employees should download applications through vendor-controlled channels rather than relying on search rankings, GitHub pages or third-party links alone.
- Restrict unauthorized applications and administrator privileges. Controlling which applications can run and limiting unnecessary administrative access can reduce the opportunity for unverified AI software to establish itself on corporate endpoints.
- Inspect downloads and application behavior. Check Point Endpoint Security includes Threat Emulation for detecting unknown and evasive attacks, while browser protection can inspect malicious files originating from internet sources. This is relevant to campaigns such as Yoba where the initial package reaches the endpoint through a download.
- Detect malicious activity beyond the initial file. Check Point Endpoint Security also provides Anti-Bot, anti-malware, behavioral protection and incident analysis capabilities, providing additional layers of protection when a malicious application attempts to execute or communicate from an endpoint.
- Extend prevention across the attack chain. ThreatCloud AI provides threat intelligence and protection against known and unknown malware, command-and-control activity and machine-generated domains, which are particularly relevant to campaigns that combine malware delivery with generated domains and unconventional communication infrastructure.
For the full technical analysis, read the research from Check Point Research here.
