Attackers have used fake ChatGPT and Claude desktop applications hosted on GitHub to distribute a malware chain that abuses legitimate signed binaries to evade security protections.
In research published October 27, Check Point said it had tracked the campaign, which it calls Yoba, for two months, though an earlier variant posing as the Cursor coding agent appeared in early June. The fake projects impersonated artificial intelligence (AI) applications including GPT-5.6 Sol, GPT-6 Astra and Claude Opus.
Their releases sat in GitHub repositories with GitHub Pages landing pages, and some of the repositories appeared among Google’s top results, most likely through search engine optimization (SEO) poisoning.
Yoba Uses Signed Binaries to Hide Malicious Components
The fake applications bundled legitimate signed OpenAI and Anthropic executables with a malicious dynamic link library (DLL). Check Point found that the signed Setup.exe files loaded the malicious component through DLL sideloading, a technique often used to bypass security protections.
The malicious DLL, dubbed YobaDropper, ran several checks before deploying a second-stage loader, including the name of its host process and whether it had administrator privileges.
It also checked keyboard layouts to avoid machines in Commonwealth of Independent States (CIS) countries other than Ukraine and used lengthy sleeps to frustrate automated analysis. Check Point said the actor showed indicators suggesting Russian origins.
The dropper then created a directory under ProgramData, copied a legitimate Windows executable into it and used Scheduled Tasks to establish persistence, with a task running under the Local System account and disguised as a Microsoft task.
YobaLoader Uses Telegram and DNS to Fetch Payloads
The second-stage YobaLoader used Telegram and encrypted Domain Name System (DNS) lookups, known as DNS-over-HTTPS (DoH), to obtain instructions without dedicated command-and-control (C2) infrastructure, according to Check Point.
It took an image from a Telegram channel and used data from it to generate domains through a domain generation algorithm.
It then queried Google’s DoH service for encrypted data stored in DNS records, which was cryptographically validated before the loader retrieved and decrypted the next-stage payload.
Check Point advised organizations to be cautious when installing AI applications from unverified repositories and to restrict the execution of software from unknown sources.
The observed payload was an XMRig cryptominer, but the researchers said YobaLoader is a generic loader, so future waves could deliver other executable or PowerShell payloads.