Yoba campaign uses fake AI apps to deliver a crypto miner

Check Point researchers have uncovered a campaign in which attackers host fake ChatGPT and Claude desktop applications on GitHub to distribute a malware chain that abuses legitimately signed binaries to bypass security protections. The operation, dubbed Yoba, has been active since June with an earlier variant masquerading as Cursor coding agent and impersonating AI tools such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus.

The fake projects sit in GitHub repositories with GitHub Pages landing pages and have appeared high in Google search results, suggesting SEO poisoning as a distribution driver, according to Check Point.

The campaign hinges on signed, legitimate OpenAI and Anthropic executables bundled with a malicious DLL, YobaDropper, which loads via DLL sideloading to evade protections. The dropper performs host-process checks, privilege checks, and even keyboard-layout checks to avoid CIS countries other than Ukraine, with long sleeps to hinder automated analysis.

It creates a ProgramData directory, copies a legitimate Windows executable, and uses a Scheduled Task with Local System privileges masquerading as a Microsoft task for persistence. The second stage, YobaLoader, communicates via Telegram and DNS-over-HTTPS to fetch payloads without a dedicated C2, generating domains from a Telegram image and validating cryptographically via Google DoH before retrieving the next-stage payload.

The observed payload is an XMRig cryptominer, though Check Point notes YobaLoader is a generic loader that could deliver other executables or PowerShell in future waves.