Science & Tech · Cybersecurity · 11 hrs ago
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Attackers used fake ChatGPT and Claude apps on GitHub to spread a malware chain called Yoba, according to Check Point researchers.
The fake projects were made to look like AI tools, and some appeared high in Google search results.
The malware hid alongside legitimate, signed software and used a technique called DLL sideloading to get around security protections.
It also checked the computer it was on and created a scheduled task to stay active.
Yoba’s loader used Telegram and encrypted DNS lookups to fetch instructions, avoiding the need for a dedicated command-and-control server.
The observed payload mined cryptocurrency, but researchers say the loader could deliver other kinds of malware in future attacks.
Organizations are advised to avoid unverified downloads and restrict unknown software, while researchers warn that the threat could evolve.
Attackers used fake ChatGPT and Claude desktop apps on GitHub to distribute the Yoba malware chain.
The apps bundled legitimate signed OpenAI or Anthropic executables with malicious DLLs that were loaded through DLL sideloading.
YobaDropper used delays and system checks to hinder analysis, then established persistence with a scheduled task.
YobaLoader used Telegram and Google’s DNS-over-HTTPS service to obtain instructions and fetch a payload.
Researchers observed an XMRig cryptominer, but said the loader could deliver other threats.
- Who
- Attackers behind the Yoba campaign, tracked by Check Point Research.
- What
- Fake AI desktop apps distributed Yoba malware, including a loader and an observed XMRig cryptominer.
- When
- Check Point said it tracked the campaign for two months; an earlier Cursor-themed variant appeared in early June. The research was published October 27.
- Where
- Fake projects and landing pages were hosted on GitHub and GitHub Pages.
- Why
- The campaign used signed executables and common online services to evade security protections and make its command-and-control traffic harder to detect.
This story does not have two clearly opposing sides.
An earlier Yoba variant posing as the Cursor coding agent appeared.
Check Point published research on the campaign.
Infosecurity Magazine and SC Media published articles about the campaign.
The Hacker News published an article about the campaign.
- Campaign name
- Yoba
- Fake app names
- GPT-5.6 Sol, GPT-6 Astra and Claude Opus
- Initial malware component
- YobaDropper
- Second-stage component
- YobaLoader
- Observed payload
- XMRig cryptominer
3 sources
What people are saying
The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections
By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity