Threat actors are distributing malicious software under the guise of AI desktop tools for ChatGPT and Claude, using signed executables to stealthily install crypto miners. The campaign, dubbed Yoba, sets up fake GitHub projects claiming they’re new AI clients like “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus,” but instead package malware known as YobaLoader.
Deceptive Setup and Delivery
The attackers trick victims into downloading ZIP archives from GitHub repositories that also include GitHub.io pages promoting the fake AI software. Hidden within each archive are two key components: a legitimate signed executable (Setup.exe) impersonating an OpenAI or Anthropic app, and a malicious DLL (winmm.dll) designed to be loaded by the executable through DLL sideloading. This gives the malware a veneer of legitimacy and helps it evade detection.
The malicious DLL, called YobaDropper, employs multiple anti-analysis techniques. It checks whether it is running under “Setup.exe” by validating the file’s name hash, and refuses to execute in sandboxed environments. It adds a long sleep routine—over 200,000 cycles of Sleep(5500), effectively delaying behavior for about 12.7 days. Furthermore, it excludes machines with keyboard layouts corresponding to several former Soviet states, including Armenia, Azerbaijan, and Belarus, seeking to sidestep scrutiny from researchers in those regions.
Loader, C2, and Crypto Miner
Once YobaDropper passes its checks, it uses a DLL sideloading chain involving wmpdmc.exe and ampdui.dll, copying the former from the system folder into a new “WMProcess” directory. It then decrypts a payload and schedules the signed Setup.exe to run to trigger the infecting process.
The next phase kicks in with YobaLoader. It downloads an image via Telegram, uses the last 50 bytes of that image to seed a Domain Generation Algorithm (DGA), and then queries DNS-over-HTTPS APIs to fetch commands hidden in DNS TXT records. These commands lead to the download of additional malicious payloads, including one executed as an XMRig crypto miner, injected into svchost.exe.
The campaign’s first GitHub repo surfaced in July 2026, but its malicious releases only appeared at the end of August. Earlier versions were stricter with geographic blocks—excluding just Russia—and included a range of anti-debugging or virtual machine evasion methods. Later variants dropped some restrictions while retaining core stealth features.
Why This Campaign Works
The Yoba campaign shows how attackers exploit public trust in AI software. By packaging malware alongside well-known brand executables and using legitimate GitHub hosting, the campaign reduces suspicion. They also exploit search engine optimization to get their GitHub pages to rank well, increasing visibility and the chances of downloads.
Users visiting search engines looking for AI clients or tools may land on these deceptive projects, unwittingly download the malicious ZIPs, and trigger the infection chain.
Mitigations: Verify software from official sources; check digital signatures; monitor unexpected tasks and executables running on endpoints; employ sandboxing solutions, but don’t rely on them alone; use security tools that analyze behavior beyond filename trust.
Closing Thoughts: The Yoba campaign underscores the evolving threat landscape where AI hype becomes a vector for malware. As public interest in AI grows, so do the incentives for attackers to weaponize trust. Staying safe will require a combination of technical defenses and careful sourcing practices. Watch for future campaigns exploiting other trending AI names and amplification techniques.
