Fake AI app downloads deliver cryptominer through signed binaries

Check Point Research has traced a campaign they call Yoba that lures victims with fake GitHub projects pretending to be AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The attackers attach malicious payloads to ZIP releases hosted alongside signed OpenAI and Anthropic binaries, a tactic known as DLL sideloading that helps them bypass some protections.

The campaign relies on convincing branding and hosting on GitHub and GitHub Pages, coupled with SEO poisoning to rank highly in external search engines, and uses multiple authentic-looking components to conceal the malware chain.

The malicious chain comprises the YobaDropper and YobaLoader. The dropper masquerades as winmm.dll and performs anti-analysis checks, including a DJB2 hash of the host name and a long sleep loop, language checks that exclude CIS-region languages, and dynamic Windows API resolution with hash-based lookups. It drops a second stage payload as wmpdui.dll via a signed OpenAI setup or a signed Claude setup, then uses Scheduled Tasks to maintain persistence by sideloading the loader through a legitimate binary.

The loader repeats the anti-analysis checks, obtains a payload via a DNS TXT tasking channel, and decrypts it to deploy a final payload. In the observed campaign, the final payload is an XMRig 6.26.0 cryptominer that connects through a Tor SOCKS5 proxy to a TLS-enabled onion mining endpoint, with DoH and a DNS-based command channel designed to bypass some monitoring.

The actors appear to be of Russian origin and operate primarily in UTC-4 time, while the DoH-driven C2 uses a base64-encoded, Ed25519-signed DNS TXT response, then AES-ECB decryption to reveal the download URL. Indicators include the GitHub repositories and pages listed in the report, the signed binaries, and the Yoba-related domain and Telegram-based infrastructure.