Threat reportMalwareTL-2026-4589
Yoba Malware Campaign Abuses Signed ChatGPT and Claude Binaries via Fake GitHub Repositories to Deploy XMRig Miner
Yoba Malware Campaign Abuses Signed ChatGPT and Claude (TL-2026-4589), also tracked as Yoba, is a high-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects Microsoft Windows (endpoints running administrator-level installers), maps to 23 MITRE ATT&CK techniques (T1036.004, T1036.005, T1053.005), and is covered by 9 detection rules and 38 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 38Indicators of compromise
Key facts for TL-2026-4589
- Threat ID
- TL-2026-4589
- Also known as
- Yoba, YobaDropper, YobaLoader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, general consumers
- Target regions
- Global (excluding CIS countries)
- Detection rules
- 9
- Indicators of compromise
- 38
- Updates
- 2026-10-28 · revalidated 1× · latest source
Malware and tooling in Yoba Malware Campaign Abuses Signed ChatGPT and Claude
Malware and tooling: YobaLoader, xmrig, Tor - S0183, XMRig 6.26.0
How Yoba Malware Campaign Abuses Signed ChatGPT and Claude works
The Yoba campaign uses fake GitHub repositories and GitHub Pages sites impersonating ChatGPT and Claude desktop apps (GPT-5.6 Sol, GPT-6 Astra, Claude Opus), promoted via SEO poisoning, to deliver ZIPs containing a legitimately signed Setup.exe and a malicious winmm.dll. YobaDropper and YobaLoader sideload via signed binaries, resolve C2 through a Telegram profile image and Google DNS-over-HTTPS TXT records, and deploy an XMRig miner tunnelled over Tor.
Check Point Research (published 2026-10-27) documents Yoba, a malware chain distributed through counterfeit GitHub projects and GitHub Pages sites (gpt-5-6.github.io, gpt-6-astra.github.io, opus-5-0.github.io) that impersonate AI desktop clients. Victims are lured through SEO poisoning on Google Search. Each GitHub release ZIP (sol-setup.zip, GPT-6-Astra-Setup.zip, Setup-Claude.zip) bundles a real, signed Setup.exe from OpenAI or Anthropic together with a malicious winmm.dll that Setup.exe sideloads. The dropper (YobaDropper) validates that it was launched from the expected host process by comparing a DJB2 hash of the executable name; on mismatch it sleeps for roughly 12.7 days (200,000 x Sleep(5500)). It requires administrator rights (prompting 'Please run this program as Administrator.'), and checks keyboard layouts to skip systems in Russia and other CIS countries (Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, Tatar).
For persistence the dropper creates %ProgramData%\WMProcess\, copies the legitimate Windows Media Player executable WMPDMC.exe from System32 into it, and drops a malicious wmpdui.dll (YobaLoader) that WMPDMC.exe loads through DLL search-order hijacking. A scheduled task authored as 'Microsoft Corporation', described as 'Collects device metadata for Windows Media Player.', runs the copied binary as Local System three minutes after boot (PT3M).
YobaLoader downloads the profile image of the Telegram channel t.me/yoba_fanclub and uses its last 50 bytes to seed a domain generation routine (FNV-1a with three word lists) producing names of the form adjective-noun-verb-number.dedyn.io (number 0-999; older variants used .aber.ir). It queries Google DNS-over-HTTPS (dns.google/resolve) for TXT records, e.g. calm-piano-floats-313.dedyn.io. The TXT value is Base64, Ed25519-signed and AES-ECB encrypted; its first character selects the deployment method (1 = URL fetch of a payload hosted at files.catbox.moe, e.g. files.catbox.moe/z5zpy9.dat). Payloads run via (1) NtWriteVirtualMemory/NtCreateThreadEx injection into svchost.exe, (2) execution as %TEMP%\<10 random chars>.exe with Zone.Identifier ADS removal, or (3) hidden PowerShell with ExecutionPolicy Bypass.
The observed final payload is XMRig 6.26.0 configured for a Tor v3 onion mining server over TLS, via an embedded Tor 0.4.9.12 bundle with lyrebird 0.8.1 obfs4 bridges (extracted to %TEMP%\torbundle\data, SOCKS5 127.0.0.1:9550), 85% CPU hint, donation level 0, pausing while the user is active, and mutex Local\WindowsSecurity. Earlier variants (June 2026) used a Cursor.exe lure, a startup-shortcut persistence method, .aber.ir DGA domains, and anti-debug/anti-VM checks later removed. GitHub accounts were created 2026-07-16; first malicious releases appeared 2026-08-30 (GPT-5.6 Sol), 2026-08-31 (Claude Opus) and 2026-09-04 (GPT-6 Astra). Check Point notes Russian-language operational security indicators and timezone clues (UTC+4, UTC-4, UTC+3) but does not name a tracked actor; attribution is not established. No CVE is involved; severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-4589
Defense Evasion
T1036.004 Masquerade Task or Service; T1036.005 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497.001 System Checks; T1574.001 DLL
Persistence
Execution
T1059.001 PowerShell; T1106 Native API; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1568.002 Domain Generation Algorithms; T1573.001 Symmetric Cryptography
Impact
defense-impairment
T1553.005 Mark-of-the-Web Bypass
Resource Development
T1583.006 Web Services; T1608.001 Upload Malware; T1608.006 SEO Poisoning
Discovery
Affected products and versions in Yoba Malware Campaign Abuses Signed ChatGPT and Claude
- Microsoft — Windows (endpoints running administrator-level installers)
Vulnerable versions: Windows 10; Windows 11 - OpenAI / Anthropic (impersonated brands) — ChatGPT and Claude desktop installers (legitimate signed Setup.exe abused for sideloading)
Vulnerable versions: Counterfeit repackaged installers only
Remediation for Yoba Malware Campaign Abuses Signed ChatGPT and Claude
Immediate actions
- Block dns.google DoH TXT lookups for *.dedyn.io from non-browser processes and alert on any *.dedyn.io resolution
- Block or alert on files.catbox.moe downloads from endpoints and on t.me/yoba_fanclub profile image fetches by non-browser processes
- Hunt for %ProgramData%\WMProcess\, WMPDMC.exe/wmpdui.dll outside System32, and scheduled tasks running as SYSTEM with author 'Microsoft Corporation' launching from ProgramData
- Hunt for XMRig and tor/lyrebird processes under %TEMP%\torbundle and the mutex Local\WindowsSecurity
- Block the listed obfs4 bridge IPs and quarantine hosts that executed Setup.exe from the fake repositories
Workarounds
- Block github.io projects and GitHub accounts gpt-5-6, gpt-6-astra, opus-5-0 and daxschneiderdjuu at the proxy
- Remove the WMProcess scheduled task and directory, then reimage hosts where loader execution is confirmed
Longer-term hardening
- Restrict software installation and local administrator rights so installers requiring elevation are reviewed
- Allow-list AI desktop clients only from official vendor download pages and package managers
- Alert on signed binaries loading winmm.dll or wmpdui.dll from non-system directories
- Deploy EDR behavioral detection for DLL sideloading and svchost.exe remote-thread injection
- User awareness on fake AI app repositories and SEO-poisoned search results
Weaknesses (CWE) in Yoba Malware Campaign Abuses Signed ChatGPT and Claude
Timeline of Yoba Malware Campaign Abuses Signed ChatGPT and Claude
- Earlier Yoba variant using a Cursor.exe lure observed (June 2026; exact day not stated)
- Attacker-controlled GitHub accounts and repositories (gpt-5-6, gpt-6-astra, opus-5-0) created
- Legitimate signed OpenAI Setup.exe later abused for sideloading was compiled (PE timestamp)
- First malicious release: fake GPT-5.6 Sol with malicious winmm.dll (compiled 2026-08-30 19:14 UTC)
- Fake Claude Opus release published on GitHub
- Third variant, fake GPT-6 Astra, released
- Related fake installer deployment noted in third-party (Simvay) reporting cited by GridinSoft
- Check Point Research publishes analysis of Yoba; press coverage the same day
Update history for TL-2026-4589
- 2026-10-28 — Yoba campaign: YobaDropper/YobaLoader delivered via fake GitHub AI-app repos using DLL sideloading of signed OpenAI/Anthropic Setup.exe binaries, dropping XMRig miner: What changed No severity, exploitability, status or attribution field changes; the existing record already reflects ACTIVE exploitation at HIGH severity. The update is additive intelligence only. New indicators (11) 7 additional SHA1s (2 Yo
Sources cited for Yoba Malware Campaign Abuses Signed ChatGPT and Claude
- Tricks from the Past deployed via signed ChatGPT and Claude binaries - Check Point Research
- Yoba Malware Targets ChatGPT & Claude Users With Fake AI Apps - Check Point Blog
- Yoba: Fake AI Installers Abuse Signed Apps to Hide a Miner - GridinSoft
- Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads - Cyber Security News
- Add Yoba and Sirius malware network indicators - ARPSyndicate/encryptlayer-intelligence PR #28
Detection coverage for TL-2026-4589
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4589 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.