The Hacker Newsinfo@thehackernews.com (The Hacker News)
Fake ChatGPT and Claude Apps Deploy Cryptocurrency Miners
Check Point Research has disclosed a campaign named Yoba that delivers malicious loaders and cryptocurrency miners masquerading as AI desktop applications purportedly tied to OpenAI’s ChatGPT and Anthropic’s Claude. The operation relies on fake GitHub projects for desktop apps such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, which internally deploy a malware family named YobaLoader.
The loader is designed to operate alongside legitimate signed OpenAI or Anthropic executables, utilising DLL sideloading to load the malicious code indirectly and bypass some security protections, according to Check Point. GitHub[.]io pages are used to describe the purported capabilities, with varying sender addresses and time-zone claims that appear intended to mask the actors’ real location.
The deployment chain starts with a ZIP hosted in these repositories containing two key components: Setup.exe (a legitimate signed OpenAI Codex or Claude binary) and a malicious DLL, winmm.dll, which is sideloaded by Setup.exe. The dropper, YobaDropper, performs host-checks by hashing the basename of the running executable and comparing it to a hard-coded value (0xE6C2F326); it will only run when launched by Setup.exe and will not execute in sandbox environments.
Anti-analysis measures include up to 200,000 iterations of Sleep(5500) and a regional check excluding keyboards from several countries, with Ukraine notably absent. YobaLoader then loads further payloads, using a second anti-sandbox check tied to wmpdmc.exe (hash 0x552751E3) before downloading a Telegram-hosted image, executing a domain-generation algorithm to form a DoH-based domain, querying Google’s DoH API for a Base64-encoded command, and retrieving a final payload from files.catbox[.]moe.
The final stage injects into svchost.exe and runs the XMRig miner. Evidence indicates the initial GitHub project was created around July 2026, with malicious releases appearing late August, and early versions only excluding Russia before later updates.