Fake ChatGPT/Claude Desktop Apps on GitHub Deliver YobaDropper Malware via DLL Sideloading
Check Point researchers uncovered a malware campaign dubbed Yoba that distributes fake desktop applications impersonating ChatGPT (branded as "GPT-5.6 Sol" and "GPT-6 Astra") and Claude Opus, hosted on GitHub and GitHub.io pages optimized to rank in Google search results. The attackers bundle a malicious winmm.dll alongside a genuine, validly signed OpenAI/Anthropic executable, exploiting DLL sideloading so the legitimate signed binary loads the attacker's payload. The malware, named YobaDropper, checks for administrator privileges and filters by keyboard language (excluding Russian and Belarusian, but not Ukrainian) before proceeding. Once installed, it persists via a scheduled task and deploys YobaLoader, which ultimately delivers XMRig cryptominer traffic routed through Tor, though the loader also supports arbitrary EXE and PowerShell payloads.
Detalhes técnicos
YobaLoader uses a novel C2 resolution technique: it downloads a Telegram channel's profile image and extracts the final 50 bytes to generate a domain name, allowing the operator to change infrastructure simply by swapping the image. It then queries Google's DNS-over-HTTPS service to retrieve instructions from a DNS TXT record, verifies and decrypts them, and fetches an encrypted payload from Catbox in the observed chain. The XMRig miner can pause activity while the victim actively uses the machine to avoid detection via noticeable resource consumption.
Remediação
Check Point recommends sourcing AI tools only from official, verified publishers and restricting execution of applications from unknown repositories or publishers. A valid code signature on a bundled executable does not guarantee the overall installer package is safe; organizations should scrutinize DLL sideloading risks and limit administrator privilege grants for newly downloaded software.
Linha do tempo
-
Fake ChatGPT/Claude Desktop Apps on GitHub Deliver YobaDropper Malware via DLL Sideloading
ler a análise desta fonte ocultar
Check Point researchers uncovered a malware campaign dubbed Yoba that distributes fake desktop applications impersonating ChatGPT (branded as "GPT-5.6 Sol" and "GPT-6 Astra") and Claude Opus, hosted on GitHub and GitHub.io pages optimized to rank in Google search results. The attackers bundle a malicious
winmm.dllalongside a genuine, validly signed OpenAI/Anthropic executable, exploiting DLL sideloading so the legitimate signed binary loads the attacker's payload. The malware, named YobaDropper, checks for administrator privileges and filters by keyboard language (excluding Russian and Belarusian, but not Ukrainian) before proceeding. Once installed, it persists via a scheduled task and deploys YobaLoader, which ultimately delivers XMRig cryptominer traffic routed through Tor, though the loader also supports arbitrary EXE and PowerShell payloads.Technical Details
YobaLoader uses a novel C2 resolution technique: it downloads a Telegram channel's profile image and extracts the final 50 bytes to generate a domain name, allowing the operator to change infrastructure simply by swapping the image. It then queries Google's DNS-over-HTTPS service to retrieve instructions from a DNS TXT record, verifies and decrypts them, and fetches an encrypted payload from Catbox in the observed chain. The XMRig miner can pause activity while the victim actively uses the machine to avoid detection via noticeable resource consumption.
Remediation
Check Point recommends sourcing AI tools only from official, verified publishers and restricting execution of applications from unknown repositories or publishers. A valid code signature on a bundled executable does not guarantee the overall installer package is safe; organizations should scrutinize DLL sideloading risks and limit administrator privilege grants for newly downloaded software.