Hackers Abuse Signed ChatGPT and Claude Applications to Deploy Yoba Malware and Evade Detection

Hackers are distributing Yoba malware through fake ChatGPT and Claude downloads, pairing legitimate, digitally signed applications with malicious libraries.

The campaign uses trusted software and GitHub hosting to make dangerous installers appear credible, ultimately deploying a cryptocurrency miner on compromised Windows computers.

The attack does not require compromising OpenAI or Anthropic. Instead, criminals place malicious files beside authentic executables and exploit how those programs load supporting libraries.

A valid signature protects the signed executable’s integrity, but it does not guarantee that neighboring files are safe.

Analysts from PolySwarm noted in their November 2 threat report that Yoba combines signed application abuse, environmental checks, and layered payload delivery.

Their assessment draws on Check Point Research’s investigation, which tracked fraudulent AI repositories for approximately two months.

Hackers Abuse Signed ChatGPT and Claude Applications

Attackers created GitHub repositories and GitHub Pages websites advertising supposed desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.

Visitors were directed to ZIP archives distributed through GitHub releases. Earlier reporting on fake GitHub AI downloads describes the same campaign’s use of familiar branding to encourage installation.

Researchers traced repositories to July 2026, with malicious releases appearing in late August and early September. Some projects ranked prominently in Google searches despite showing no artificially inflated stars or forks.

Check Point assessed that search visibility likely involved SEO poisoning, rather than confirming how rankings were manipulated. Inside the archives, a genuine signed installer loads YobaDropper through DLL sideloading.

The malicious library exposes 180 functions to resemble a Windows multimedia component, but its harmful logic runs from its entry point. Related signed software sideloading attacks show how this technique extends beyond AI-themed lures.

Before continuing, YobaDropper checks its host executable’s name. A mismatch triggers 200,000 sleep cycles lasting 5.5 seconds each, delaying execution beyond many automated analysis windows.

It also filters keyboard layouts, excluding Russian, Belarusian, Armenian, Azerbaijani, Kazakh, and other language environments while explicitly exempting Ukrainian. Administrator privileges are required to proceed.

The dropper then copies a legitimate Windows Media Player component into a ProgramData directory and decrypts another malicious library.

A scheduled task running as Local System launches the copied executable after a three-minute startup delay. Microsoft-themed task details help disguise this second sideloading stage, which activates YobaLoader.

Telegram Tasking, XMRig Mining, and Detection Priorities

YobaLoader retrieves a Telegram channel’s profile image and feeds its final 50 bytes into a domain generation algorithm. Changing that image changes the generated domain, allowing operators to redirect the infection chain without rebuilding the malware.

The loader queries Google’s DNS-over-HTTPS service for a TXT record, validates returned instructions using Ed25519 signatures, and decrypts them using AES in ECB mode.

It then downloads an encrypted payload from hosting services such as Catbox. Separately documented hidden XMRig mining campaigns illustrate how DNS records and image content can support concealed delivery chains.

Researchers observed XMRig 6.26.0 injected into a Windows service process. Mining traffic passed through a local Tor SOCKS5 proxy, while activity monitoring paused mining during computer use.

YobaLoader also supports executable and hidden PowerShell payloads, although information theft and ransomware deployment were not documented.

Defenders should investigate unexpected DLL loads, Microsoft-themed scheduled tasks, and Windows executables running from unusual directories. Reviewing complete execution chains matters more than trusting signatures alone; the observed miner is only one payload this loader can deliver.

Indicators of compromise (IoCs):-

Component	SHA-256
YobaDropper	2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c
YobaDropper	e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221
YobaDropper	2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4
YobaDropper	8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739
YobaDropper	73076c366edd5b8b351f04725663d2189a92dfdc93cc34740a61a1de9bbde51e
YobaDropper	b29cbf1bdde86ab15b5789e30dab7ce74c14ffd98f9d7e8b4f9887000e6d6834
YobaLoader	715e3ae134195f89d8da82ec4cbe6ba1d596d756a2c207a95f75a94afcdff3a4
YobaLoader	7a9d66a4637ee2a1ee1e82cfa5db91f720b757aa8fe1457e0807b1f2210b308e
YobaLoader	4d75c5461b65a2944b12414f1e5ef301fe411c1968788134d90aaaa6a50e68dd

Artifact	Investigation context
winmm.dll	Initial malicious sideloaded library
wmpdui.dll	Second-stage malicious library
WMProcess	Directory created under ProgramData
Setup.exe	Legitimate signed installer abused
WMPDMC.exe	Legitimate Windows executable copied
Cursor.exe	Earlier variant’s expected host
dedyn[.]io	Shared dynamic DNS service
svchost.exe	Observed payload injection target
Zone.Identifier	Origin metadata removed before execution

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.