Hackers Use Signed ChatGPT and Claude Binaries to Deploy Malware via Fake GitHub Downloads
A new malware campaign dubbed Yoba is abusing signed binaries from OpenAI and Anthropic, disguised as fake AI desktop apps on GitHub, to deploy an XMRig miner.
A sophisticated malware campaign, identified as Yoba, is actively targeting users by exploiting the immense popularity of AI tools like ChatGPT and Claude. Threat actors are creating fake GitHub repositories that masquerade as desktop applications, such as "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus." These repositories are strategically placed on GitHub, a platform widely trusted by developers and users, lending an air of legitimacy to the malicious software. The campaign's success hinges on tricking unsuspecting individuals into downloading and running these fake installers, which can lead to complete system compromise.
Check Point Research has detailed how these fake projects utilize GitHub Pages to host deceptive descriptions and download buttons. These buttons direct users to ZIP files stored within GitHub's release sections. Notably, the repositories avoid common social engineering tactics like fake stars or forks to appear popular. Instead, they seem to achieve high visibility in search engine results, likely through SEO poisoning techniques that manipulate titles, descriptions, and domain names to rank them prominently. The downloaded ZIP files are also intentionally left without password protection, potentially to bypass automated security scanners.
This tactic of disguising malware within legitimate-looking AI tools is not entirely new. Researchers have previously observed similar campaigns, including fake DeepSeek TUI repositories hiding malware and counterfeit installers impersonating Claude, Grok, and WormGPT. In one instance, a fake Claude website distributed a backdoor named Beagle. The Yoba campaign, however, stands out due to its specific use of signed binaries from major AI providers.
The core of the Yoba campaign's technical execution involves a technique known as DLL sideloading. Each malicious ZIP file contains a legitimate, digitally signed Setup.exe binary from either OpenAI or Anthropic, alongside a malicious winmm.dll file. When the legitimate Setup.exe is executed, Windows's standard library loading mechanism can be tricked into loading the rogue DLL from the same directory. This allows the malicious code to run under the guise of a trusted, signed process, making it significantly harder for security software to detect and flag.
The dropper component, YobaDropper, includes several anti-analysis and anti-evasion measures. It verifies if it's running under its expected name, Setup.exe, and will terminate if run in isolation or a sandbox. It also checks the victim's system language, specifically avoiding systems configured for Russian and several former Soviet Union languages. If the user lacks administrator privileges, the dropper displays a message and exits. Upon successful privilege escalation, it creates a hidden folder, copies a legitimate Windows Media Player file into it, and drops a second malicious library, YobaLoader.
Persistence is established through a scheduled task, labeled as a Microsoft component to appear legitimate, which is set to run three minutes after system boot. YobaLoader employs a novel command and control (C2) mechanism. Instead of contacting a fixed server, it dynamically generates domain names by reading the profile image of a specific Telegram channel, "yoba_fanclub." The last 50 bytes of the image are used to construct a new domain, making it difficult to block by simply blacklisting IP addresses or domains. Furthermore, it queries Google's DNS-over-HTTPS service for commands hidden within DNS TXT records, disguising malicious traffic as normal encrypted web browsing.
The final payload observed in this campaign is the XMRig cryptocurrency miner, which communicates through the Tor network. Researchers warn that the YobaLoader is designed to be generic, meaning future iterations could deliver a wide range of other malware, including ransomware, data-stealing trojans, or banking malware. While some indicators suggest Russian origins and specific time zone activity, the exact attribution remains unclear, highlighting the evolving tactics of financially motivated cybercriminals.
To mitigate these threats, users are strongly advised to download AI tools exclusively from official vendor websites and to meticulously vet GitHub repositories by examining owner reputation, account age, and commit history. Security teams should implement robust monitoring for DLL sideloading attempts, unusual scheduled tasks, and anomalous DNS traffic. Limiting administrator privileges and blocking unknown software sources remain fundamental security practices against such evolving threats.