Hackers planted malware in fake ChatGPT and Claude downloads on GitHub, using legitimate application files to help execute malicious code.
Check Point Research identified the campaign as Yoba in an Oct. 27 disclosure. Attackers packaged digitally signed executables from OpenAI and Anthropic alongside malicious files, exposing Windows users who ran the counterfeit installers to infection.
The risk extends beyond cryptocurrency mining: Yoba establishes persistence, and its loader can deliver other Windows executable files or PowerShell scripts.
Search results directed users to malicious GitHub releases
GitHub repositories and accompanying GitHub Pages sites advertised supposed desktop versions of GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Check Point traced the earliest repository to Jul. 16, with malicious ZIP releases uploaded between Aug. 30 and Sept. 4.
Promotional pages offered links to the archives, and some projects appeared prominently in Google Search results. Researchers considered their visibility consistent with SEO poisoning, a technique attackers use to promote harmful websites in search rankings.
Inside the ZIP files, a digitally signed Setup.exe from OpenAI or Anthropic appeared with a malicious winmm.dll.
Launching the installer caused the program to load the nearby DLL through DLL sideloading, executing the attackers' code without altering the legitimate executable. Check Point said its research did not indicate that OpenAI, Anthropic, ChatGPT, or Claude had been compromised.
Yoba establishes persistence and downloads a cryptocurrency miner
YobaDropper, the component loaded during setup, verified that the expected installer had launched it and introduced lengthy delays when the check failed. It also inspected keyboard-language settings and prompted users to rerun the program with administrator privileges when those permissions were absent.
With administrator access, YobaDropper copied WMPDMC.exe, a legitimate Windows program, into a directory under ProgramData and placed another malicious DLL, wmpdui.dll, beside it. A scheduled task disguised as a Windows Media Player operation ran the program three minutes after startup, activating the second-stage YobaLoader.
YobaLoader read data from a Telegram channel's profile image to generate a changing domain name. Queries through Google's DNS-over-HTTPS service returned encrypted instructions directing the malware to a payload hosted on Catbox. By combining public services with changing domains, the loader avoided relying on a single fixed command server.
Check Point's campaign summary identified the XMRig cryptocurrency miner as the final payload, injected into the svchost.exe process. Mining traffic passed through Tor, while the software could pause when someone was actively using the computer. Although the loader can execute other Windows programs or PowerShell scripts, researchers did not confirm additional malware families in the investigated releases.
Enterprise security teams need to inspect more than signed files
For employees and IT professionals testing new AI tools on company computers, a recognizable software publisher is not enough to establish that a download is safe. A digital signature verifies the signer and integrity of an individual executable, not every component distributed with it.
Organizations should obtain AI software through approved distribution channels and limit administrator privileges to employees who need them. Application allowlisting can help block unauthorized software, but allowing a signed executable does not necessarily control the DLLs it loads. Security teams should verify that their policies also enforce restrictions on those DLLs.
Security analysts should also investigate application behavior after installation, even when the executable is signed. Endpoint detection and response tools can help connect unexpected DLL loads with newly created scheduled tasks and Windows processes running from unusual directories.
Organizations that find a fraudulent installer on a workstation should determine whether it ran. If execution is confirmed or cannot be ruled out, security teams should isolate the device and review its execution history against Check Point’s published indicators. Removing XMRig alone cannot confirm whether YobaLoader or its scheduled task remains active, or whether other code has executed. Affected systems should return to service only after investigators have accounted for the full infection, with a rebuild considered if its scope remains uncertain.
Read more: Familiar brands also serve as bait in mobile attacks, with fake Indeed interview apps delivering Android spyware to job seekers.