Yoba Malware Uses Fake AI Apps and Signed Binaries to Deliver a Crypto Miner

Trusted software names hide a multi-stage infection

Fake desktop apps for ChatGPT and Claude are the front door to Yoba, a malware chain that uses signed software from OpenAI and Anthropic to help run malicious code. Check Point Research says the operators promoted downloads called GPT-5.6 Sol, GPT-6 Astra and Claude Opus through GitHub repositories and project pages, then bundled a malicious DLL beside legitimate executables.

The execution method is DLL sideloading: a trusted program loads a malicious library placed where Windows will find it. In this case, the signed executable lends the package a familiar appearance, while the DLL carries the first malicious stage. That stage, named YobaDropper by the researchers, installs YobaLoader, which retrieves and runs a later payload.

The observed final payload is XMRig, a cryptocurrency miner. Yet the loader can retrieve other Windows executable or PowerShell payloads, so the miner is only one possible outcome of the same delivery chain. That flexibility is the main operational concern: the lure and delivery infrastructure could stay in place while the downloaded payload changes.

Search results lead to GitHub-hosted installers

The repositories imitate AI products, but researchers found no sign that the operators inflated stars or forks to boost their standing inside GitHub. Instead, the pages appeared among Google’s top results, which Check Point attributes to search optimization. GitHub Pages sites described the supposed apps and linked directly to ZIP files hosted as GitHub releases.

That route gives a download a plausible setting: a project page, a source repository and a release package all sit on a well-known development platform. The repositories’ appearance does not establish that the software is authentic, however. The files themselves contain the evidence that matters, including a DLL compiled on the day it was added to the archive.

The researchers identified three project themes and associated email addresses: GPT-5.6 Sol used edwardcarlsonmkym[@]outlook[.]com, GPT-6 Astra used daxschneiderdjuu[@]outlook[.]com, and Claude Opus used rioprestonlfyx[@]outlook[.]com. Commit metadata recorded UTC offsets of +4, -4 and +3 hours. Check Point interprets the mixed offsets as possible concealment; other timing evidence in the files points to activity around UTC-4.

The first repository appeared in July 2026, while malicious releases arrived at the end of August, followed by another roughly five days later. The researchers’ timeline lists sol-setup.zip on August 30, Setup-Claude.zip on August 31 and GPT-6-Astra-Setup.zip on September 4. The releases had no password protection. The report says that low detection rates, supported by anti-analysis behavior, may have made password protection unnecessary.

Archive timestamps expose the malicious component

The ChatGPT-themed archives contain largely matching files and indicators, despite being uploaded several days apart. Most components resemble parts of a standard application package. Among them, winmm.dll has an archive timestamp of August 30, 2026, 15:14:20, and a compilation timestamp of 19:14:19 UTC. The other principal files were compiled on August 19. That close match between DLL compilation and archive creation led the researchers to identify winmm.dll as the likely malicious component.

The archive’s Setup.exe is a signed OpenAI executable. In the Claude package, the corresponding file is a signed Anthropic executable. Both are used to load the malicious DLL. In other words, the signature belongs to the legitimate host program; it does not validate the adjacent library or the package as a whole.

YobaDropper checks its surroundings before installing

The first-stage DLL mimics the exports of the normal Windows winmm.dll, but the researchers found that all 180 exported functions contain only a return instruction and padding. The entry point holds the working code. This lets the file present an expected interface while keeping most of those apparent functions inert.

Before proceeding, YobaDropper hashes the name of its host process using DJB2 and compares the result with 0xE6C2F326, the value for Setup.exe. Running the DLL outside that expected host does not simply end the process. Instead, it enters a lengthy delay loop: 200,000 calls to Sleep(5500), about 12.73 days in total, while adding decoded filler text to a local buffer. That behavior can frustrate analysis environments that expect a sample to reveal its actions quickly.

A second check looks at the keyboard layout to filter out selected language settings associated with CIS countries. It tests language IDs in the range 0x19–0x44 against the bitmask 0xEC0400C8401, with Ukrainian ID 0x22 explicitly excluded from the filter. The list of excluded languages includes Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek and Tatar. Earlier Yoba versions filtered Russian alone; the newer dropper applies regional filtering earlier in the chain.

The malware also resolves Windows functions dynamically by hashing exported function names in kernel32.dll and ntdll.dll. It uses DJB2 with seed 0x1505. Before unpacking its embedded payload, it checks for administrator privileges. If it lacks them, it displays “Please run this program as Administrator” and exits, leaving the user to restart the app with elevated access.

Once those checks pass, the dropper creates ProgramData\WMProcess, copies the legitimate WMPDMC.exe from System32 into that directory, and decrypts an embedded payload using XOR with the seed string IRANNUMBERONE. It saves the result as wmpdui.dll. A scheduled task then starts the copied Windows Media Player executable, which sideloads the new DLL. The task is dressed up with the author name “Microsoft Corporation” and a description saying it collects device metadata for Windows Media Player. It runs as Local System and is delayed three minutes after startup.

YobaLoader retrieves tasking through ordinary services

The second stage, wmpdui.dll, shares much of the dropper’s code, suggesting a common developer. It checks that it is running under WMPDMC.exe, using the expected process-name hash 0x552751E3. Both stages use DJB2 for process-name checks, but their API-resolution hashes differ: the dropper uses seed 0x1505, while the loader uses 0x1DEB. Reusing the algorithm with separate seeds adds friction for analysis tools that depend on a single hash mapping.

The loader’s network flow avoids a fixed command server. It decrypts a Telegram channel address, t[.]me/yoba_fanclub, requests the page with a basic Windows browser user agent, and extracts the URL of the channel’s profile image. The image is more than decoration: its final 50 bytes seed a domain-generation algorithm.

The algorithm hashes those bytes against lists of adjectives, nouns and verbs, then generates a number from 0 to 999. The resulting domain follows the form adjective-noun-verb-number.dedyn[.]io. Changing the Telegram image changes the seed and can therefore produce a different domain without changing the loader itself.

YobaLoader queries Google’s DNS-over-HTTPS endpoint for a TXT record at that generated domain. It Base64-decodes the response, checks an Ed25519 signature against a built-in public key, then decrypts the validated data with AES in ECB mode. In the observed sample, the decrypted instruction points to https://files.catbox[.]moe/z5zpy9.dat. The downloaded payload is encrypted with the same AES key and decrypted after retrieval.

This arrangement spreads the chain across Telegram, Google’s DNS service, Tor and a file-hosting site rather than relying on dedicated command infrastructure. That makes traffic harder to distinguish from ordinary web activity, although each dependency also gives defenders useful places to look: the Telegram channel and image, generated DNS names, TXT responses, and the hosting URL.

Three execution paths, one observed miner

The first character in the decrypted task selects one of three ways to run the retrieved payload. Option one injects it into svchost.exe using NtWriteVirtualMemory and NtCreateThreadEx. The loader finds that process by hashing its name and matching 0xC26CDEA5. Option two writes an executable under a randomly named directory in the user’s temporary folder, removes its Zone.Identifier metadata, and starts it. Option three saves a PowerShell script in the same temporary location and runs it with a hidden window and execution-policy bypass parameters.

Check Point observed the first path delivering XMRig 6.26.0. The miner connects over TLS to an onion address through a local Tor SOCKS5 proxy. The bundle can unpack Tor 0.4.9.12 and lyrebird 0.8.1, and it includes two obfs4 bridges. Mining pauses while the user is active and resumes after 240 seconds of inactivity. The configuration also sets an 85% CPU thread hint and uses the mutex Local\WindowsSecurity.

The miner can conditionally load the WinRing0 driver service for MSR-based optimization. Its pool endpoint, token, Tor settings and other details appear in the researchers’ indicators below. These specifics describe the observed payload; the three delivery choices make clear that YobaLoader can run other executable or PowerShell code supplied through its signed DNS tasking.

Earlier builds show the operator’s changes

Researchers traced an earlier YobaDropper to early June 2026. That version expected to run under Cursor.exe, associated with a fake Cursor AI coding-agent download. Another recorded process hash, 0x39DE0DD8, remains unidentified. The earlier sample shared much of the newer malware’s functionality, but its deployment and evasion details differed.

The first dropper Base64-decoded its embedded buffer before XOR decryption; later builds removed the Base64 step. It also used a Startup-folder shortcut named msdefender_scheduler{7940-8490-6670-1081}.lnk to launch a copied msdtc.exe and sideload mswsock.dll. Newer samples instead use a scheduled task and the copied Windows Media Player executable.

The early loader excluded Russian-language systems, while later versions moved that check into the dropper and broadened the excluded set. Its domain-generation approach stayed similar, but used .aber[.]ir rather than .dedyn[.]io; it also injected into a process identified by hash 0x21BD94C2.

Earlier builds had extra debugger and virtual-machine checks that are absent from the newer variants. The debugger check searched Windows kernel object types for DebugObject. The virtual-machine scoring routine examined the hypervisor-present flag, timing, vendor strings, CPU brand data and firmware information; a score of at least three out of six was needed to continue. The Telegram channel and image seed remained consistent across versions, suggesting the operator retained that part of the setup while changing evasion and execution methods.

What defenders should take from the chain

Yoba’s practical lesson is that a valid signature on a familiar executable does not establish that a downloaded application bundle is trustworthy. Teams should treat unofficial AI desktop clients as untrusted software, especially when a GitHub page links to a release archive that places additional DLLs beside a signed host. The observed chain also requires administrator access and creates a scheduled task, both useful points for endpoint monitoring.

The operator appears to have iterated on the loader while preserving the Telegram-based seed and flexible tasking mechanism. The next payload could differ from the miner, so defenders should track the behavior and delivery pattern as well as individual file hashes. Check Point’s report includes Yara rules for the dropper and loader, along with indicators covering the project pages, archives, DLLs, Telegram image, DNS query, download and mining endpoints.

Selected indicators

• GitHub projects: github[.]com/gpt-5-6/sol-free-desktop, gpt-5-6.github[.]io, github[.]com/gpt-6-astra/gpt-6-astra.github.io, gpt-6-astra[.]github[.]io, opus-5-0[.]github[.]io.
• Telegram channel: t[.]me/yoba_fanclub. Observed download: files.catbox[.]moe/z5zpy9.dat.
• Observed DNS query: dns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXT.
• Observed mining endpoint: 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443; Tor bridges included 51.89.228[.]250:21668 and 51.89.231[.]85:24526.
• Sample hashes and Yara rules are listed in the Check Point Research report.