Malicious actors are deploying Yoba malware by masquerading it within seemingly legitimate downloads for ChatGPT and Claude desktop apps. The scheme blends authentic signed executables with malicious libraries to trick users into installing harmful software disguised as AI tools.
These fake apps bear titles like “GPT-5.6 Sol”, “GPT-6 Astra”, and “Claude Opus”. While the primary executables are properly digitally signed, harmful components are stitched alongside via DLL sideloading. The installers are housed in GitHub repositories and distributed with releases that users download as ZIP files. Despite lacking many obvious signs of popularity—no fake forks or star counts—the repos still show up high in Google searches, likely boosted by SEO manipulation. Research pinpointed the campaign’s start around July 2026, with malicious releases surfacing in August and September. 1
How the Malware Operates
Once a user runs one of the compromised installers, a signed executable loads a malicious dropper (YobaDropper) using DLL sideloading. This malicious library declares around 180 functions that mimic those of a Windows multimedia component, but its real purpose begins at its entry point. If the hosting process doesn’t match certain expected names, or if the system’s language settings are in Russian or select former Soviet states, execution gets delayed—through numerous sleep cycles designed to evade automated analysis tools.
After obtaining administrator rights, the dropper copies a legitimate Windows Media Player component into the ProgramData folder, then decrypts a second malicious library. A scheduled task disguised with Microsoft branding creates another stage. Once triggered, this stage runs as Local System and loads a component called YobaLoader.
Advanced Techniques: Loader, Mining, and Control
YobaLoader leverages a surprisingly versatile infrastructure for control. It pulls a Telegram channel’s profile image, takes its last 50 bytes, and uses them in a domain-generation algorithm (DGA). Changing the profile image lets attackers shift control domains without rebuilding malware. It also queries Google’s DNS-over-HTTPS service for TXT records, validates instructions via Ed25519 signatures, then uses AES-ECB decryption to unveil the final payload—often delivered through third-party hosts like Catbox.
One observed payload was XMRig cryptocurrency miner (version 6.26.0), injected into legitimate Windows service processes. Mining traffic was funneled through a local Tor SOCKS5 proxy, and the miner paused operations while users were actively using the machine. Though no data theft or ransomware has been confirmed yet, YobaLoader can also deliver PowerShell or arbitrary executables.
Security teams should watch for odd DLL loads, Microsoft-themed tasks in Task Scheduler, executables running from nonstandard locations like ProgramData, and anything masquerading inside signed installers. A valid signature only guarantees the signed file itself hasn’t been altered—not that everything around it is safe. Integrated threat intelligence and full execution-chain analysis are essential to spot Yoba operations.
Indicators of compromise include specific SHA-256 hashes for YobaDropper and YobaLoader components, legitimate Windows components (e.g. winmm.dll, wmpdui.dll), and host executables like Setup.exe being abused. Directory names like WMProcess inside ProgramData, and task names camouflaged with Microsoft branding are also red flags.
While no direct breaches of OpenAI or Anthropic systems have been detected, this tactic exploits the trust users place in official branding and digital signatures to trick victims into installing malware. The attackers capitalize on side-loading vulnerabilities rather than cutting corners by trying to break into core systems.
What this means going forward: digital trust—especially in signed apps—can’t be taken for granted. As threat actors adopt increasingly clever maneuvering—domain generation, delayed triggers, language-based evasion—they turn what users assume is safe into attack vectors. Organizations and individuals alike must combine signature verification with environmental awareness, behavioral analysis, and vigilance toward supporting files—not just executables. Keeping systems patched, monitoring unexpected scheduled tasks, and scrutinizing where DLLs are loaded from will be among the most effective defenses.
