# Yoba Malware Campaign Abuses Signed ChatGPT and Claude Binaries via Fake GitHub Repositories to Deploy XMRig Miner

> The Yoba campaign uses fake GitHub repositories and GitHub Pages sites impersonating ChatGPT and Claude desktop apps (GPT-5.6 Sol, GPT-6 Astra, Claude Opus), promoted via SEO poisoning, to deliver ZIPs containing a legitimately signed Setup.exe and a malicious winmm.dll. YobaDropper and YobaLoader sideload via signed binaries, resolve C2 through a Telegram profile image and Google DNS-over-HTTPS TXT records, and deploy an XMRig miner tunnelled over Tor.

- **Published:** 2026-10-28T02:44:12Z
- **Last reviewed:** 2026-10-28T04:11:34.860Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4589
- **ID:** TL-2026-4589
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Research (published 2026-10-27) documents Yoba, a malware chain distributed through counterfeit GitHub projects and GitHub Pages sites (gpt-5-6.github.io, gpt-6-astra.github.io, opus-5-0.github.io) that impersonate AI desktop clients. Victims are lured through SEO poisoning on Google Search. Each GitHub release ZIP (sol-setup.zip, GPT-6-Astra-Setup.zip, Setup-Claude.zip) bundles a real, signed Setup.exe from OpenAI or Anthropic together with a malicious winmm.dll that Setup.exe sideloads. The dropper (YobaDropper) validates that it was launched from the expected host process by comparing a DJB2 hash of the executable name; on mismatch it sleeps for roughly 12.7 days (200,000 x Sleep(5500)). It requires administrator rights (prompting 'Please run this program as Administrator.'), and checks keyboard layouts to skip systems in Russia and other CIS countries (Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, Tatar).

For persistence the dropper creates %ProgramData%\WMProcess\, copies the legitimate Windows Media Player executable WMPDMC.exe from System32 into it, and drops a malicious wmpdui.dll (YobaLoader) that WMPDMC.exe loads through DLL search-order hijacking. A scheduled task authored as 'Microsoft Corporation', described as 'Collects device metadata for Windows Media Player.', runs the copied binary as Local System three minutes after boot (PT3M).

YobaLoader downloads the profile image of the Telegram channel t.me/yoba_fanclub and uses its last 50 bytes to seed a domain generation routine (FNV-1a with three word lists) producing names of the form adjective-noun-verb-number.dedyn.io (number 0-999; older variants used .aber.ir). It queries Google DNS-over-HTTPS (dns.google/resolve) for TXT records, e.g. calm-piano-floats-313.dedyn.io. The TXT value is Base64, Ed25519-signed and AES-ECB encrypted; its first character selects the deployment method (1 = URL fetch of a payload hosted at files.catbox.moe, e.g. files.catbox.moe/z5zpy9.dat). Payloads run via (1) NtWriteVirtualMemory/NtCreateThreadEx injection into svchost.exe, (2) execution as %TEMP%\<10 random chars>.exe with Zone.Identifier ADS removal, or (3) hidden PowerShell with ExecutionPolicy Bypass.

The observed final payload is XMRig 6.26.0 configured for a Tor v3 onion mining server over TLS, via an embedded Tor 0.4.9.12 bundle with lyrebird 0.8.1 obfs4 bridges (extracted to %TEMP%\torbundle\data, SOCKS5 127.0.0.1:9550), 85% CPU hint, donation level 0, pausing while the user is active, and mutex Local\WindowsSecurity. Earlier variants (June 2026) used a Cursor.exe lure, a startup-shortcut persistence method, .aber.ir DGA domains, and anti-debug/anti-VM checks later removed. GitHub accounts were created 2026-07-16; first malicious releases appeared 2026-08-30 (GPT-5.6 Sol), 2026-08-31 (Claude Opus) and 2026-09-04 (GPT-6 Astra). Check Point notes Russian-language operational security indicators and timezone clues (UTC+4, UTC-4, UTC+3) but does not name a tracked actor; attribution is not established. No CVE is involved; severity is analyst-assigned.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1574.001 DLL
- T1036.004 Masquerade Task or Service
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1497.001 System Checks
- T1553.005 Mark-of-the-Web Bypass
- T1614.001 System Language Discovery
- T1102.001 Dead Drop Resolver
- T1568.002 Domain Generation Algorithms
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1090.003 Multi-hop Proxy
- T1496.001 Compute Hijacking
- T1583.006 Web Services
- T1608.001 Upload Malware
- T1106 Native API
- T1036.005 Masquerading
- T1105 Ingress Tool Transfer

## Sources

- [Tricks from the Past deployed via signed ChatGPT and Claude binaries - Check Point Research](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/)
- [Yoba Malware Targets ChatGPT & Claude Users With Fake AI Apps - Check Point Blog](https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users)
- [Yoba: Fake AI Installers Abuse Signed Apps to Hide a Miner - GridinSoft](https://blog.gridinsoft.com/yoba-fake-ai-installers-signed-apps/)
- [Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads - Cyber Security News](https://cybersecuritynews.com/fake-github-chatgpt-claude-malware/)
- [Add Yoba and Sirius malware network indicators - ARPSyndicate/encryptlayer-intelligence PR #28](https://github.com/ARPSyndicate/encryptlayer-intelligence/pull/28)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4589