Fake ChatGPT and Claude Apps Deliver Yoba Malware Through GitHub

Check Point, whose analysts observed cryptocurrency-mining software being installed on Windows computers, calls the campaign Yoba. The fake GitHub projects offer supposed "GPT-5.6 Sol," "GPT-6 Astra" and "Claude Opus" desktop apps. The attackers promoted them through GitHub project pages, some of which appeared among the top Google results, and linked to ZIP downloads hosted on GitHub releases.

Running the package launches a genuine signed executable that loads a malicious file named winmm.dll through DLL sideloading. The malicious DLL, named YobaDropper by researchers, exits without administrator privileges and excludes several keyboard languages, including Russian and Belarusian. A scheduled task then launches a copied Windows executable that loads YobaLoader, allowing the infection to survive a restart.

According to Check Point, YobaLoader reads a Telegram channel's profile image to generate a domain name and queries Google's DNS-over-HTTPS service for instructions stored in a DNS TXT record. Researchers observed XMRig cryptocurrency-mining software communicating through Tor. The loader also supports Windows executable and PowerShell payloads.

למה זה חשוב Signed executables from well-known AI vendors do not establish that a download is genuine when the package around them is not. Security teams should treat AI desktop apps obtained from GitHub pages or search results as untrusted, restrict execution of software from unknown publishers, and watch for unexpected DLLs loaded beside signed applications and for scheduled tasks that relaunch copied executables. Investigators can use the Telegram-image and DNS TXT steps described by Check Point as indicators to pivot on.