Yoba campaign: fake ChatGPT and Claude GitHub apps use signed-binary DLL sideloading to deploy XMRig miner

Linha do tempo

1. securityaffairs.com ↗ · pub. 30/10/2026 18:22 · coletado 30/10 21:00

   Yoba campaign uses fake GitHub AI apps and DLL sideloading to deploy a Tor-routed XMRig miner

   ler a análise desta fonte ocultar

   Check Point Research has tracked a roughly two-month campaign dubbed Yoba. It uses fake GitHub projects posing as AI desktop apps (e.g. "GPT-5.6 Sol", "GPT-6 Astra", "Claude Opus") to deliver a custom malware chain. The lure pages likely rank high on Google through SEO poisoning. Each ZIP release pairs a legitimately signed OpenAI or Anthropic executable renamed Setup.exe with a malicious winmm.dll that is sideloaded. The chain ends in an XMRig cryptocurrency miner, but the tasking system can deliver any PE or PowerShell payload. Check Point assesses, without confirming, that the actors may be of Russian origin and mainly operate in UTC-4.

   Technical Details

   • Lure: each project has a GitHub repository, a GitHub.io page and a ZIP release. The first repository appeared around July 2026, and malicious releases landed on Aug 30-31 and Sep 4. Each repository uses a different Outlook address, and commit times vary (UTC+4, UTC-4, UTC+3), apparently to mask the actor's time zone. Earlier versions from June 2026 used Cursor.exe for sideloading.
   • YobaDropper (winmm.dll): runs only if the hash of the parent process name matches Setup.exe. Otherwise it sleeps 200,000 x 5.5 s (~12.73 days) to defeat sandboxes. It skips hosts with CIS keyboard layouts (Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, Tatar) but not Ukrainian. It requires administrator rights and shows "Please run this program as Administrator." if they are missing.
   • Persistence: creates ProgramData\WMProcess, copies the legitimate WMPDMC.exe from System32 and drops the second stage as wmpdui.dll. A scheduled task masquerading as Microsoft (author "Microsoft Corporation", Windows Media Player metadata description) runs 3 minutes after boot as Local System and sideloads the DLL.
   • YobaLoader: shares code with the dropper, runs only under WMPDMC.exe and uses a different hash seed. It downloads the profile picture of Telegram channel t[.]me/yoba_fanclub. The last 50 bytes seed a DGA that builds adjective-noun-verb-number domains on dedyn[.]io. It then queries a TXT record via Google DNS-over-HTTPS, verifies the signature and decrypts a Catbox payload link. Earlier versions used .aber[.]ir and had anti-debug/anti-VM checks.
   • Execution options: injection into svchost.exe, saving an executable after removing Zone.Identifier, or a hidden PowerShell script bypassing execution policy.
   • Payload: XMRig 6.26.0 with a hidden command line, mining to a TLS onion endpoint through a local Tor SOCKS5 proxy. It can unpack Tor 0.4.9.12 and lyrebird 0.8.1, uses ~85% of CPU threads, pauses on user activity (resumes after 240 s idle) and can load the WinRing0 driver for MSR optimization.

   Remediation

   • Hunt for WMPDMC.exe copies under ProgramData, fake Microsoft scheduled tasks, Telegram-related traffic, DoH lookups for dedyn[.]io via dns.google, and unexplained high CPU usage.
   • Avoid installing AI tools from unverified repositories and enforce policies restricting software from unknown sources.
   • Combine user awareness with basic technical controls.
2. thehackernews.com ↗ · pub. 29/10/2026 12:20 · coletado 29/10 13:00

   Yoba campaign: fake ChatGPT and Claude desktop apps on GitHub sideload YobaLoader to drop XMRig miners

   ler a análise desta fonte ocultar

   Check Point Research detailed a campaign dubbed Yoba in which threat actors publish fake GitHub repositories posing as AI desktop apps (GPT-5.6 Sol, GPT-6 Astra, Claude Opus) to distribute the YobaLoader malware family. The ZIP archives bundle a legitimate signed OpenAI Codex / Anthropic Claude Setup.exe with a malicious winmm.dll that is loaded via DLL sideloading. Credibility is boosted with GitHub.io landing pages and apparent SEO poisoning to surface the repos in Google results. The final payload is an XMRig cryptominer injected into svchost.exe. The first repository appeared around July 2026, with malicious releases uploaded at the end of August.

   Technical Details

   • YobaDropper (winmm.dll) validates it is hosted by Setup.exe by hashing the basename against 0xE6C2F326, defeating standalone sandbox execution.
   • Anti-analysis: 200,000 iterations of Sleep(5500) (~12.73 days) and skipping hosts with keyboard layouts for Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, plus Tatar. Ukraine is notably absent from the exclusion list; early versions excluded only Russia and had more anti-debug/anti-VM checks.
   • A second sideload chain uses wmpdmc.exe copied from system32 into ProgramData\WMProcess alongside the dropped wmpdui.dll; persistence via a scheduled task.
   • YobaLoader checks its host hash against 0x552751E3, downloads an image from Telegram channel t[.]me/yoba_fanclub, uses the last 50 bytes as a DGA seed producing adjective-noun-verb-digit.dedyn[.]io, then queries Google DNS-over-HTTPS for a Base64 TXT record resolving to the next stage at files.catbox[.]moe/z5zpy9.dat.
   • Repos used separate burner emails and inconsistent upload time zones (UTC+4, UTC-4, UTC+3) to obscure attribution.

   Remediation

   Block and monitor the listed GitHub repositories and domains, alert on DoH queries to unusual dedyn.io subdomains, inspect ProgramData\WMProcess and scheduled tasks launching wmpdmc.exe, and restrict installation of AI desktop tools to official vendor channels.

3. infosecurity-magazine.com ↗ · pub. 28/10/2026 12:13 · coletado 28/10 16:01

   Yoba campaign spreads XMRig via fake ChatGPT and Claude desktop apps on GitHub using signed binaries and DLL sideloading

   ler a análise desta fonte ocultar

   Check Point reported on October 27 a campaign it calls Yoba, tracked for two months, in which fake ChatGPT and Claude desktop applications hosted on GitHub distribute a malware chain that abuses legitimate signed binaries to evade defenses. An earlier variant posing as the Cursor coding agent appeared in early June. The fake projects impersonated AI apps such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and some repositories ranked among Google's top results, most likely through SEO poisoning. The observed final payload was an XMRig cryptominer, but the loader is generic and could deliver other payloads in future waves. Check Point said the actor showed indicators suggesting Russian origins.

   Technical Details

   • Fake apps bundle legitimate signed OpenAI and Anthropic executables (Setup.exe) with a malicious DLL, which is loaded via DLL sideloading.
   • The malicious DLL, YobaDropper, checks its host process name and administrator privileges, checks keyboard layouts to avoid CIS countries other than Ukraine, and uses long sleeps to frustrate automated analysis.
   • It creates a directory under ProgramData, copies a legitimate Windows executable there, and persists via a Scheduled Task running as Local System and disguised as a Microsoft task.
   • The second-stage YobaLoader fetches an image from a Telegram channel and uses its data to generate domains via a domain generation algorithm. It then queries Google's DNS-over-HTTPS service for encrypted data in DNS records, which is cryptographically validated before the next-stage payload is retrieved and decrypted. This avoids dedicated C2 infrastructure.
   • The loader can deliver other executable or PowerShell payloads.

   Remediation

   • Avoid installing AI applications from unverified repositories.
   • Restrict execution of software from unknown sources.
4. gbhackers.com ↗ · pub. 28/10/2026 01:58 · coletado 28/10 03:00

   Fake GPT-5.6 Sol, GPT-6 Astra and Claude Opus GitHub apps deliver Yoba malware via DLL sideloading of signed binaries

   ler a análise desta fonte ocultar

   Check Point Research reports a campaign that uses fraudulent GitHub repositories and GitHub Pages, apparently promoted through SEO poisoning, to advertise non-existent desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The download buttons deliver ZIP archives containing legitimately signed OpenAI and Anthropic executables repackaged with a malicious DLL. The vendors themselves were not compromised. The chain installs YobaDropper and YobaLoader, which fetch commands through Telegram, dynamic DNS and DNS-over-HTTPS. The observed payload was the XMRig 6.26.0 cryptominer routed over Tor, but the loader can run arbitrary PE or PowerShell payloads.

   Technical Details

   • Running Setup.exe sideloads the malicious winmm.dll (YobaDropper), which spoofs 180 exports containing only RET and NOP instructions.
   • Anti-analysis: the DLL checks that the host basename produces a DJB2 hash of 0xE6C2F326 (Setup.exe). If the check fails, it runs 200,000 Sleep(5500) calls (about 12.73 days) while appending filler text. It resolves APIs by DJB2 hash (seed 0x1505).
   • Geofencing: a keyboard-language bitmask (0xEC0400C8401) avoids systems using Russian, Belarusian, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Tajik, Turkmen, Uzbek and Tatar. Ukrainian is excluded from the avoided list.
   • Administrator rights are required. The dropper creates %ProgramData%\WMProcess, copies the legitimate WMPDMC.exe from System32, and XOR-decrypts its embedded loader (key IRANNUMBERONE) to wmpdui.dll.
   • Persistence: a scheduled task falsely labeled with the author "Microsoft Corporation" and the description "Collects device metadata for Windows Media Player". It runs as Local System three minutes after boot and launches WMPDMC.exe, which sideloads YobaLoader. The loader accepts only host hash 0x552751E3 and uses API hash 0x1DEB.
   • C2: the loader requests t[.]me/yoba_fanclub, hashes the last 50 bytes of the profile image to build a domain such as calm-piano-floats-313.dedyn[.]io, and queries its TXT record via Google DNS-over-HTTPS. The response is Base64-decoded, its Ed25519 signature verified (public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64) and the commands decrypted with AES-ECB (key 1d0d1368b4d53f3a6322cf40e84e63db).
   • Execution paths: inject a PE into svchost.exe (NtWriteVirtualMemory, NtCreateThreadEx); drop and run a randomly named EXE after deleting its Zone.Identifier; or run a hidden PowerShell script with -ExecutionPolicy Bypass.
   • Payload: XMRig 6.26.0 fetched from Catbox, routed through Tor 0.4.9.12 and lyrebird 0.8.1 to a TLS onion pool. It pauses mining until 240 seconds of user inactivity, uses the mutex Local\WindowsSecurity, can load WinRing0 for MSR optimization and hints at 85% CPU threads.
   • Earlier variants (June 2026) targeted Cursor.exe, persisted via a Startup shortcut, used .aber[.]ir DGA domains and added checks for DebugObject, CPUID, timing, CPU brand and SMBIOS.

   Remediation

   • Restrict installation of unapproved AI software.
   • Alert on signed processes loading DLLs from writable directories.
   • Inspect suspicious scheduled tasks, especially those masquerading as Microsoft tasks.
   • Monitor Telegram, Catbox, Tor, dynamic DNS and unusual DNS-over-HTTPS TXT queries.
5. blog.checkpoint.com ↗ · pub. 27/10/2026 10:00 · coletado 27/10 13:00

   Yoba malware campaign uses fake ChatGPT and Claude GitHub apps and signed binaries to sideload XMRig

   ler a análise desta fonte ocultar

   Check Point Research has documented Yoba, a malware campaign that uses fake GitHub repositories and GitHub Pages sites posing as desktop apps for ChatGPT and Claude (names such as "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus"). Victims download malicious ZIP files from GitHub releases. The packages include legitimate, signed OpenAI and Anthropic executables that sideload a malicious DLL, which starts YobaDropper and YobaLoader. The malicious projects ranked prominently in Google Search, consistent with SEO poisoning. The final payload observed was XMRig 6.26.0, but YobaLoader is generic and can deliver other Windows executables or PowerShell payloads. OpenAI, Anthropic, ChatGPT and Claude were not compromised.

   Technical Details

   • Delivery: fake GitHub repos and GitHub Pages sites lead to ZIP files in GitHub releases. There was no evidence of inflated stars or forks.
   • Sideloading: the signed OpenAI Setup.exe (ChatGPT lures) or a signed Claude executable (Claude lure) loads a malicious winmm.dll placed next to it (DLL sideloading).
   • YobaDropper: checks that it was launched by the expected Setup.exe and delays execution if not. It also applies regional language checks and requires administrator privileges. It then deploys YobaLoader next to a legitimate Windows executable and creates a scheduled task so that executable sideloads YobaLoader after startup.
   • C2 and payload retrieval: YobaLoader fetches a Telegram channel's profile image and derives a domain from its data, so the operator can rotate domains by changing the image. It queries Google DNS-over-HTTPS for a TXT record on that domain, validates and decrypts the response, and retrieves an encrypted payload from hosting such as Catbox.
   • Payload: XMRig 6.26.0 communicates over Tor and pauses mining while the user is active.

   Remediation

   • Download AI applications only from vendor-controlled channels, not from search results, GitHub pages or third-party links.
   • Restrict unauthorized applications and unnecessary administrator privileges.
   • Inspect downloads and monitor what legitimate signed applications load and execute, not just the initial file.
   • Treat a Yoba infection as a broader compromise, not just a cryptominer, because the loader can deliver other payloads.
   • Use network and endpoint protections that cover generated domains and C2 activity.
6. research.checkpoint.com ↗ · pub. 27/10/2026 10:03 · coletado 27/10 11:01 primeiro registro

   Yoba campaign: fake ChatGPT and Claude GitHub apps sideload malware via signed binaries to deploy XMRig

   ler a análise desta fonte ocultar

   Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as AI desktop apps (GPT-5.6 Sol, GPT-6 Astra, Claude Opus). The projects are promoted through apparent SEO poisoning. The ZIP releases contain legitimate signed OpenAI and Anthropic Setup.exe binaries, which sideload a malicious winmm.dll (YobaDropper). The chain avoids dedicated C2 infrastructure and uses Telegram, Tor, Catbox and DNS over HTTPS. The final observed payload is an XMRig miner injected into svchost.exe, but the YobaLoader is generic and can deliver any PE or PowerShell payload. Check Point sees indicators of Russian origin and an operator working mainly in UTC-4, and says the earliest dropper dates to June 2026.

   Technical Details

   • Initial access: malicious GitHub repositories and GitHub.io pages. Releases sol-setup.zip, Setup-Claude.zip and GPT-6-Astra-Setup.zip were uploaded between 2026-08-30 and 2026-09-04. The ZIPs are not password-protected because detection rates were already low. Each repository used a different Outlook email address and commit timezone, likely to obscure the operator's real timezone.
   • Sideloading and evasion: winmm.dll has 180 stubbed exports, and only DllEntryPoint holds code. A DJB2 hash check of the host process name (expects Setup.exe, 0xE6C2F326) acts as an anti-sandbox measure; on failure the DLL stalls with 200,000 × Sleep(5500). A keyboard-layout bitmask check (0xEC0400C8401, range 0x19–0x44) excludes CIS countries but not Ukraine (ID 0x22), similar to a technique seen in Bazarloader. The dropper requires administrator rights and resolves APIs by DJB2 hash with seed 0x1505.
   • Persistence: creates ProgramData\WMProcess, copies WMPDMC.exe there and drops an XOR-decrypted payload (key IRANNUMBERONE) as wmpdui.dll. A scheduled task runs it as SYSTEM 3 minutes (PT3M) after boot, with the author set to Microsoft Corporation.
   • YobaLoader C2: the loader reads t[.]me/yoba_fanclub, extracts the channel profile image and uses its last 50 bytes as the seed for a DGA producing $adjective-$noun-$verb-$digit.dedyn[.]io. It queries Google DoH for a TXT record, verifies it with an Ed25519 signature, decrypts it with AES-ECB and obtains a Catbox URL. The loader uses seed 0x1DEB for API hashing.
   • Payload delivery: three modes: (1) inject into svchost.exe, (2) drop and run an EXE from %TEMP% after removing Zone.Identifier, (3) run a hidden PowerShell script with ExecutionPolicy Bypass.
   • Final payload: XMRig 6.26.0 mining to a TLS onion endpoint through a local Tor SOCKS5 proxy (Tor 0.4.9.12 and lyrebird 0.8.1), pausing on user activity and optionally loading the WinRing0 driver.
   • Earlier variant (June 2026): sideloaded by Cursor.exe, with Base64+XOR unpacking and Startup-folder LNK persistence (msdefender_scheduler{7940-8490-6670-1081}.lnk, %APPDATA%\Microsaft Difendir\msdtc.exe and mswsock.dll). It excluded only Russia, used the .aber[.]ir DGA suffix, and included anti-debug (DebugObject) and anti-VM scoring checks.

   Remediation

   • Avoid installing AI tools from unverified GitHub repositories and restrict execution of software from unknown sources.
   • Hunt for the WMProcess directory, wmpdui.dll, scheduled tasks masquerading as a Windows Media Player metadata task, and svchost.exe injection.
   • Block or monitor the listed IOCs and the DGA domain pattern on dedyn[.]io.
   • Apply the Check Point YARA rules yoba_dropper and yoba_loader.