Researchers at Check Point Research have identified an active malware campaign called Yoba that tricks users into running malicious Windows applications disguised as official desktop clients for ChatGPT and Claude.
The fake installers are hosted in GitHub repositories and on GitHub Pages. Inside the distributed archives, attackers place authentic signed executables originally released by OpenAI and Anthropic. A malicious DLL placed alongside these files is loaded at runtime through classic DLL sideloading, allowing the trusted signed process to execute attacker-controlled code.
No evidence was found that OpenAI or Anthropic themselves were breached. The campaign simply reuses publicly available signed binaries to lend credibility to the malicious package.
After initial execution, Yoba establishes persistence by creating scheduled tasks in Windows. It then fetches the next-stage payload using multiple channels, including Telegram, DNS over HTTPS queries, and the Catbox file-hosting service. Even the avatar of the associated Telegram channel is used to help construct the command-and-control domain.
In the analyzed infection chain, the final payload is the XMRig cryptominer. The miner is configured to suspend mining activity whenever the user is actively using the computer, reducing the chance of detection through performance monitoring. The loader itself is capable of delivering additional malware or PowerShell scripts in future operations.
