Summary
- Yoba is distributed through fake GitHub projects advertising purported ChatGPT and Claude desktop tools.
- The installers sideload malicious DLLs alongside legitimate signed executables.
- Researchers observed cryptocurrency mining payloads but say the loader can fetch other malicious software.
Attackers are distributing malware through fake AI desktop applications that incorporate genuine, digitally signed executables from OpenAI and Anthropic, according to Check Point Research. The campaign, which investigators track as Yoba, uses counterfeit GitHub projects and associated pages promising software under names such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Neither AI company’s systems were compromised as part of the activity described.
The initial lure is built around software discovery rather than a message delivered directly to a potential victim. Attackers created repositories and GitHub Pages websites whose titles and descriptions resembled products people might search for. Their releases provided downloadable ZIP packages. The projects appeared prominently in Google results, which Check Point considers consistent with search-engine optimisation intended to make malicious installers easier to encounter. The researchers did not find evidence that GitHub engagement figures had been artificially inflated.
Inside the packages, the attackers placed legitimate signed installer or application executables alongside a malicious Windows library. When a signed program loads a supporting DLL from an attacker-controlled location, the malicious code can run in the context of an apparently legitimate process. This is DLL sideloading. It does not turn the malicious library into a trusted component, but it can complicate detection based on an executable’s name, publisher or signature alone.
Check Point identified a dropper and loader that divide the infection chain into stages. The first component checks aspects of its execution environment and installs persistence. The second retrieves payload information using third-party services and encrypted or indirect communications. The research describes use of Telegram, Tor-related infrastructure, Catbox and DNS over HTTPS instead of relying entirely on a conventional dedicated command-and-control server.
Yoba exploits the difference between the trust assigned to a signed executable and the contents of the entire download package. A digital signature can help verify that a particular binary was issued by its claimed publisher and has not been changed since signing. It does not certify a folder, archive or repository in which the binary appears. If Windows searches for a compatible DLL in a location controlled by an attacker, the integrity of the signed application and the integrity of its execution environment become separate questions. Malware authors can exploit that gap without stealing a publisher certificate.
The campaign also uses ordinary internet infrastructure for distribution and communication. A GitHub release can look less suspicious than a download from an unfamiliar domain, while routine services used for message delivery and content storage can blend with legitimate traffic. Check Point’s finding is not that those platforms knowingly participated in the attacks. The technical record identifies malicious use of their facilities and of a software-loading mechanism. The earlier fake Claude advertising campaign used a different route to a counterfeit installer, with no basis for treating the two operations as the same actor.
The final payload observed by the researchers included XMRig cryptocurrency-mining software, which uses infected computers’ processing capacity without authorisation. Earlier components establish persistence and give the loader a route to retrieve additional Windows executables or PowerShell payloads. That combination allows an operator to use the same installation for immediate mining and subsequent code delivery, without replacing the signed executable that initially attracted the download.
Yoba also uses language and environment checks that skip some systems configured for Russian and other Commonwealth of Independent States languages. Its route from search results to GitHub release archives gives counterfeit applications the outward appearance of familiar software distribution. Once extracted, the package pairs a genuine, signed executable with a malicious library positioned to load alongside it. The signature authenticates the executable itself, while the attack depends on the other file that the executable loads.
