Yoba malware hides a crypto miner in fake AI desktop projects

Check Point Research has tracked a campaign dubbed Yoba that hides a cryptocurrency miner behind legitimate OpenAI and Anthropic binaries, using fake AI desktop projects on GitHub to lure victims. The projects imitate real AI tools such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus, containing a signed setup executable alongside a malicious DLL (loadable via DLL sideloading) and a dropper called YobaDropper with a companion loader, YobaLoader.

The attackers rely on credible infrastructure, including GitHub pages and ZIP releases that are not password-protected, and employ SEO poisoning to boost search results. The campaigns’ first malicious releases appeared after July 2026, with eight- to 31 August releases and subsequent early September activity, each using different Outlook addresses and time stamps to obscure the operator’s time zone.

Once executed, the malware checks the launching program’s name, elevates privileges, and creates a WMProcess folder under ProgramData, copying a legitimate WMPDMC.exe and a second-stage payload wmpdui.dll for persistence via a signed Microsoft-angled scheduled task. YobaLoader then retrieves the final payload by contacting a Telegram channel, deriving a domain name via a 50-byte image seed, querying DNS-over-HTTPS for a signed TXT record, and obtaining a link to the payload on Catbox.

The payload can be injected into svchost.exe as an XMRig 6.26.0 miner, using a Tor-based TLS-enabled onion endpoint and a local Tor SOCKS5 proxy, with the miner throttled by user activity. In addition to mining, the DNS tasking system allows delivery of other PE executables or PowerShell payloads. Check Point notes the operators may have Russian origins, with UTC-4 time zone usage, but this attribution is not confirmed.

Defenders are advised to look for WMPDMC.exe copies under ProgramData, suspicious Microsoft-signed tasks, Telegram traffic, DoH lookups to dedyn[.]io via dns[.]google, and unusually high CPU usage.