Yoba malware hides in fake desktop versions of ChatGPT and Claude

Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found.

The researchers have been tracking the campaign, dubbed Yoba, for the past two months. Its operator set up repositories and GitHub.io pages for supposed apps called GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and hosted the malware as ZIP releases on GitHub.

“While the repositories do not show signs of fake engagement (such as artificially inflated stars or forks) that would promote them within GitHub’s own search, they still appear among the top results on Google. This is most likely due to SEO poisoning, where the attackers optimize titles, descriptions, and hosting domains to make their malicious projects rank highly in external search engines,” Check Point explained.

Google Search results (Source: Check Point)

Signed executables used as cover

Each archive contains a legitimate executable signed by OpenAI or Anthropic, packaged together with a malicious DLL that the executable loads when the victim runs it. The technique, known as DLL sideloading, is often used to get around security protections.

Check Point’s Eli Smadja wrote that the research doesn’t indicate ChatGPT, Claude, OpenAI or Anthropic were compromised. “Instead, the attackers abuse legitimate signed binaries and the credibility associated with these brands,” he added.

Malicious ZIP files hosted on legitimate platforms are usually password protected to stop automated tools from unpacking and analyzing them, but these weren’t, since the malware already had very low detection rates thanks to its anti-sandbox and other anti-analysis techniques.

The malware won’t infect computers with a keyboard layout for Russian or one of several other languages from the Commonwealth of Independent States (CIS) region, with Ukrainian explicitly left out of that exclusion list.

With administrator rights in hand, it creates a scheduled task that runs under the Local System account three minutes after each startup. To make the task look legitimate, the malware lists Microsoft Corporation as its author and describes it as a Windows Media Player task.

A Telegram profile picture leads the way

“This campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure,” the researchers stated.

Once persistence is established, the second-stage component, YobaLoader, visits a Telegram channel named yoba_fanclub, downloads the channel’s profile picture and uses part of the image to generate a domain name, so the operator can switch to a new domain simply by changing the picture.

The loader then queries that domain through Google’s DNS over HTTPS service and retrieves an encrypted record that, once verified and decrypted, holds a link to a file hosted on Catbox, which it downloads.

By leaning on DNS over HTTPS and common file hosting services, the operator aims to bypass passive DNS monitoring and some gateway-based protections and make the traffic harder to tell apart from regular user activity, the company noted. And since the domain changes with the picture, blocking a single malicious server or domain does less to stop the wider delivery mechanism.

A loader ready for other payloads

In this campaign, the final payload is the XMRig cryptocurrency miner, which is injected into a Windows process, connects to its mining server through Tor and pauses while the user is active at the computer.

The loader can run any executable or PowerShell script the operator sends it, though, and the researchers warn that future waves may deliver different malware families.

That makes the loader more significant than the miner seen in this campaign, and Check Point recommends that organizations finding Yoba on their systems treat the infection as a broader compromise and look beyond detecting or removing XMRig.

An earlier version of the dropper appeared in early June 2026 and was built to run under a process named Cursor.exe, suggesting the lure at the time was the Cursor AI coding agent. That variant used the same Telegram channel and profile image.

The person behind the campaign shows signs of Russian origin and appears to work mostly in the UTC-4 time zone, according to the analysis. Each repository was set up with a different email address and showed a different time zone, likely in an attempt to obscure the operator’s true time zone.

“The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance,” Check Point concluded. “Organizations should be cautious about installing ‘AI helpers’ or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources.”