Yoba malware abuses signed AI binaries to deploy a crypto miner

Check Point Research has detailed a Yoba malware campaign that sideloads payloads by abusing signed OpenAI and Anthropic binaries. Attackers promoted fake desktop apps under names such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus 5 Free, with an earlier wave impersonating Cursor AI. The distribution relied on fake GitHub repositories and GitHub Pages, plus search-engine poison to push pages to the top of Google results.

Between 30 August and 4 September 2026, three unencrypted ZIP releases were uploaded to GitHub, attracting 269 downloads for GPT-5.6 Sol, 82 for Claude Opus, and 352 for GPT-6 Astra, totalling 703 downloads. The campaign’s payloads included a legitimate, digitally signed binary renamed Setup.exe and a malicious library tracked as YobaDropper, which later drops a second-stage loader named YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to deploy a cryptocurrency miner.

The infection chain features anti-sandbox checks, persistence, and a chain of signed components. Setup.exe triggers the dropper, which cryptographically sideloads YobaDropper into memory and creates a WMProcess folder in ProgramData, copying WMPDMC.exe from System32 and dropping wmpdui.dll (YobaLoader). A Local System scheduled task then launches WMPDMC three minutes after boot.

YobaLoader, which can inject into svchost.exe, uses a domain generated from the profile picture of a Telegram channel called yoba_fanclub by reading the image’s last 50 bytes to assemble a .dedyn[.]io domain; it then queries Google DNS-over-HTTPS for a TXT record, authenticates with an embedded Ed25519 key, and decrypts an AES-ECB payload.

The observed wave injected XMRig 6.26.0, routed mining traffic through Tor 0.4.9[.]12 and obfs4 bridges to a hidden onion pool, using up to 85% of CPU threads and pausing when the user moves the mouse. Researchers note that a valid signature does not guarantee safety for all bundled components.