Yoba Campaign: 3 Fake ChatGPT and Claude Desktop Apps on GitHub Deliver XMRig Miner via DLL Sideloading

A malware campaign tracked by Check Point Research as "Yoba" is distributing fake desktop installers for OpenAI ChatGPT and Anthropic Claude through GitHub repositories, using DLL sideloading against signed binaries to deliver a dropper, a loader and an XMRig cryptocurrency miner, according to Check Point Research's analysis published October 27, 2026 and reported by The Hacker News on October 29, 2026. The fake projects, named "GPT-5.6 Sol," "GPT-6 Astra" and "Claude Opus," are hosted on GitHub with matching GitHub.io landing pages and surface in top Google search results through SEO poisoning, with no victim organizations named and no confirmed victim count as of the reporting date.

What was the specific vulnerability?

The campaign does not exploit a product flaw: it abuses trust in legitimate, code-signed executables from OpenAI and Anthropic to load a malicious library placed alongside them. "The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections," Check Point Research said in its October 27, 2026 report.

According to Check Point Research, the malicious ZIP archives contain a legitimate signed OpenAI Codex or Claude "Setup.exe" together with a malicious winmm.dll, dubbed YobaDropper. The dropper deploys YobaLoader, which fetches an image from a Telegram channel at "t[.]me/yoba_fanclub," generates a domain using a domain generation algorithm in the format "adjective-noun-verb-digit.dedyn[.]io," queries Google DNS-over-HTTPS for a Base64-encoded command, and ultimately injects an XMRig cryptocurrency miner into svchost.exe. Persistence is achieved through a scheduled task that launches the legitimate executable so that it loads the malicious payload.

The infrastructure choices avoid a dedicated command-and-control server, relying instead on Telegram, Tor, the file-hosting service Catbox and DNS-over-HTTPS. Check Point also documented anti-sandbox behavior, including hash checks that require the payload to launch under specific executable names and roughly 12.73 days of Sleep() iterations, plus keyboard-layout exclusions for Russia, Belarus and other CIS states.

How was the incident detected?

Check Point Research discovered and tracked the campaign over the two months before publishing its analysis on October 27, 2026. According to the findings, the first GitHub repository in the campaign was created around July 16, 2026, and the first malicious release, "sol-setup.zip," was uploaded on August 30, 2026. Two further releases followed: "Setup-Claude.zip" on August 31, 2026 and "GPT-6-Astra-Setup.zip" on September 4, 2026. The Hacker News reported the campaign to a wider audience on October 29, 2026, corroborating the main claims of the primary analysis, including the fake AI app repositories, the sideloading of signed binaries, the YobaDropper and YobaLoader chain, the XMRig payload and the SEO poisoning used for distribution.

What is the current impact?

Victims who downloaded the fake installers from GitHub, typically after encountering them through SEO-poisoned search results, are infected with YobaDropper and YobaLoader and run an XMRig miner on their machines. The repositories show no fake engagement metrics such as stars or forks, but according to Check Point they "still appear among the top results on Google," which is how the lures reach users searching for AI desktop applications.

No named victim organization and no confirmed victim count appear in either source as of the October 2026 reporting. The download counts visible on the releases give an indication of exposure: 269 downloads for the first release, 82 for the second and 352 for the third, per Check Point's analysis. Because this is a malware campaign rather than a software vulnerability, nothing has been "patched"; impact is bounded by detection and avoidance of the fake repositories and their indicators of compromise.

What are the next steps?

Defenders should block the documented indicators of compromise and warn users against installing AI desktop applications from GitHub links reached through search engines. Check Point assesses that indicators "suggest Russian origins," noting the actor appears to operate primarily in the UTC-4 time zone, and that three different Outlook email addresses used in the campaign carry conflicting time zones of UTC+4, UTC-4 and UTC+3, which "likely reflect a deliberate attempt to obscure the threat actor's true operational time zone." Check Point also observed that Ukraine, historically included in such exclusion checks, is missing from the keyboard-layout exclusion list. "The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance," Check Point Research said. Organizations should verify installer provenance against official vendor channels and monitor for scheduled tasks launching signed AI-tool executables that load side-by-side DLLs.

By the numbers

Source snapshot