Fake ChatGPT and Claude apps spread Yoba malware through GitHub

Researchers at Check Point Software Technologies detailed the Yoba malware campaign in a research post, saying attackers used fake GitHub projects for desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The repositories and related GitHub Pages ranked in Google results and directed users to malicious ZIP files hosted as GitHub releases.

The installers placed a malicious winmm.dll file beside legitimate, signed executables from OpenAI and Anthropic. When users ran Setup.exe, the signed executable loaded the malicious DLL. The YobaDropper then required administrator access, created a scheduled task for persistence and installed the YobaLoader through another DLL sideloading step.

YobaLoader used Telegram profile image data to generate a domain, then retrieved encrypted instructions from a DNS TXT record through Google's DNS over HTTPS service. It downloaded its payload from Catbox and could inject an executable into svchost.exe, run an executable from a temporary folder or execute a PowerShell script. Researchers observed the campaign delivering XMRig 6.26.0, which mined cryptocurrency through a Tor endpoint and paused while the user was active.

The signed programs themselves were genuine; the attackers abused them to load their own code, a technique known as DLL sideloading that can bypass security tools. Check Point said the actor shows indicators of Russian origin.