YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig

Key facts for YobaLoader malware campaign

Detection coverage for YobaLoader malware campaign

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5503 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Splunk SPL)

Detects YobaDropper persistence (TL-2026-5503): a scheduled task running as Local System three minutes after boot that launches a copy of WMPDMC.exe from C:\ProgramData\WMProcess while claiming Microsoft Corporation and a Windows Media Player description. The KQL and Sigma flavors also cover YobaLoader child activity: hidden PowerShell with execution-policy bypass and svchost.exe spawned as the XMRig injection host.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1036.004, T1036.005, T1059.001, T1055
• Data sources: wineventlog, WinEventLog:Security (EventCode 4698), sysmon (EventCode 1)
• Severity: high
• Confidence: high

Splunk SPL

(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 earliest=-24h@h) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\schtasks.exe" CommandLine="*/create*" earliest=-24h@h)
```YobaDropper persistence TL-2026-5503: Local System task three minutes after boot launching a copied WMPDMC.exe from ProgramData WMProcess while claiming Microsoft authorship```
| eval task_text=coalesce(Task_Content, TaskContent, CommandLine, Message)
| where match(task_text,"(?i)ProgramData\\\\WMProcess") OR match(task_text,"(?i)WMPDMC\\.exe")
| eval runs_as_system=if(match(task_text,"(?i)S-1-5-18|SYSTEM"),"yes","no")
| eval claims_microsoft=if(match(task_text,"(?i)Microsoft Corporation|Windows Media Player"),"yes","no")
| eval boot_trigger=if(match(task_text,"(?i)BootTrigger|onstart|PT3M"),"yes","no")
| eval creator=coalesce(Subject_Account_Name, User)
| stats count min(_time) as first_seen values(sourcetype) as sources values(runs_as_system) as runs_as_system values(claims_microsoft) as claims_microsoft values(boot_trigger) as boot_trigger values(creator) as creator values(task_text) as task_detail by host
| convert ctime(first_seen)

Microsoft KQL

let lookback = 24h;
let task_events = DeviceEvents
    | where Timestamp > ago(lookback)
    | where ActionType == "ScheduledTaskCreated"
    | extend Detail = tostring(AdditionalFields)
    | where Detail has_any ("WMProcess", "WMPDMC.exe")
    | project Timestamp, DeviceName, Stage = "Scheduled task referencing WMProcess or WMPDMC.exe", Detail, Account = InitiatingProcessAccountName, Proc = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine;
let task_cli = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create" and ProcessCommandLine has_any ("WMProcess", "WMPDMC.exe")
    | project Timestamp, DeviceName, Stage = "schtasks /create for WMPDMC.exe persistence", Detail = ProcessCommandLine, Account = AccountName, Proc = InitiatingProcessFileName, CommandLine = ProcessCommandLine;
let relocated_host = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName =~ "WMPDMC.exe"
    | where not(FolderPath startswith @"C:\Windows\System32\" or FolderPath startswith @"C:\Program Files\Windows Media Player\" or FolderPath startswith @"C:\Program Files (x86)\Windows Media Player\")
    | project Timestamp, DeviceName, Stage = "WMPDMC.exe sideload host executing from non-system path", Detail = FolderPath, Account = AccountName, Proc = FileName, CommandLine = ProcessCommandLine;
let loader_children = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "WMPDMC.exe"
    | where (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "bypass" and ProcessCommandLine has "hidden")
        or FileName =~ "svchost.exe"
    | project Timestamp, DeviceName, Stage = iff(FileName =~ "svchost.exe", "YobaLoader child svchost.exe (injection host)", "YobaLoader hidden PowerShell with execution-policy bypass"), Detail = ProcessCommandLine, Account = AccountName, Proc = FileName, CommandLine = InitiatingProcessCommandLine;
union task_events, task_cli, relocated_host, loader_children
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Stages = make_set(Stage), StageCount = dcount(Stage), Details = make_set(Detail, 10), Accounts = make_set(Account, 5) by DeviceName
| order by StageCount desc, LastSeen desc

Sigma

title: YobaLoader Persistence via Relocated WMPDMC.exe and Masquerading Scheduled Task
id: 6f0c2a4e-5d1b-4b7a-9a31-5503a0000002
status: experimental
description: Detects Yoba post-exploitation behaviour (TL-2026-5503). WMPDMC.exe executing outside the Windows Media Player locations, schtasks.exe creating a task that points at ProgramData WMProcess or WMPDMC.exe, WMPDMC.exe spawning hidden PowerShell with execution-policy bypass, or WMPDMC.exe spawning svchost.exe as an injection host for the XMRig payload.
references:
    - https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-evasion
    - attack.t1053.005
    - attack.t1036.004
    - attack.t1036.005
    - attack.t1059.001
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection_relocated_host:
        Image|endswith: '\WMPDMC.exe'
    filter_legit_locations:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Program Files\Windows Media Player\'
            - 'C:\Program Files (x86)\Windows Media Player\'
    selection_task_tool:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_task_target:
        CommandLine|contains:
            - 'WMProcess'
            - 'WMPDMC.exe'
    selection_ps_child:
        ParentImage|endswith: '\WMPDMC.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'bypass'
            - 'hidden'
    selection_svchost_child:
        ParentImage|endswith: '\WMPDMC.exe'
        Image|endswith: '\svchost.exe'
    condition: (selection_relocated_host and not filter_legit_locations) or (selection_task_tool and selection_task_target) or selection_ps_child or selection_svchost_child
falsepositives:
    - Administrators staging a copy of WMPDMC.exe for troubleshooting
    - Software deployment tools that create scheduled tasks referencing Windows Media Player components
level: high

Known false positives:

• Administrators or deployment tools creating scheduled tasks that reference Windows Media Player components
• Legitimate software that parents svchost.exe and PowerShell from a copied system binary during troubleshooting

Tuning notes: Enable audit of Other Object Access Events so Security 4698 is generated. The exact task name is not published, so detection keys on the WMProcess path and WMPDMC.exe. Exclude known management accounts and deployment tools; confirm task XML field names (Task_Content) in your Splunk Windows TA version.

• 🔒 Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Sigma) · unlock with TL Creds
• 🔒 Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Sigma) · unlock with TL Creds
• 🔒 Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Sigma) · unlock with TL Creds
• 🔒 Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Splunk SPL) · unlock with TL Creds
• 🔒 Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Splunk SPL) · unlock with TL Creds

Indicators of compromise for YobaLoader malware campaign

As of 2026-11-07, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5503.

Sample indicators (3 of 29)

• IP address: 51.89.228[.]250
• Domain: dedyn[.]io
• URL: hxxps://files[.]catbox[.]moe/z5zpy9.dat

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How YobaLoader malware campaign works

Check Point Research (report "Tricks from the Past Deployed via Signed ChatGPT and Claude Binaries", 2026-10-27) tracks a Windows-focused campaign named Yoba. Operators created fake GitHub repositories and GitHub Pages sites (first repository around 2026-07-16) impersonating AI desktop applications that do not exist: GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The repositories were promoted through SEO poisoning and ranked high in Google search results. Malicious ZIP releases were uploaded between 2026-08-30 and 2026-09-04 (sol-setup.zip, Setup-Claude.zip, GPT-6-Astra-Setup.zip). Check Point counted at least 703 downloads of the three archives (269 GPT-5.6 Sol, 82 Claude Opus, 352 GPT-6 Astra) and states there is no indication that OpenAI, Anthropic, ChatGPT or Claude were compromised; the signed binaries are used only as sideloading hosts.

Stage 1 (YobaDropper): each archive contains a legitimately signed Setup.exe next to a malicious winmm.dll that spoofs the Windows multimedia library with 180 exports containing only return instructions; the malicious logic runs from the DLL entry point. The dropper validates the host process name with a DJB2 hash (expects Setup.exe, hash 0xE6C2F326). If validation fails it sleeps 200,000 times for 5.5 seconds (about 12.7 days) to stall sandboxes. It reads the keyboard layout and exits on Russian and CIS-region layouts (Ukrainian is exempted), and it requires administrator privileges. It then creates C:\ProgramData\WMProcess, copies the legitimate Windows binary WMPDMC.exe into it, decrypts an embedded payload with an XOR routine, writes it as wmpdui.dll, and registers a scheduled task running as Local System three minutes after boot. The task claims Microsoft Corporation authorship with a Windows Media Player device-metadata description. WMPDMC.exe then sideloads wmpdui.dll, which is YobaLoader.

Stage 2 (YobaLoader): the loader avoids dedicated C2 servers. It downloads the profile image of the Telegram channel t.me/yoba_fanclub and uses the last 50 bytes as a DGA seed, generating domains from adjective, noun, verb and number word lists under dedyn.io (example: calm-piano-floats-313.dedyn.io). Changing the channel photo retargets all infections without touching the binary. The loader queries the Google DoH resolver (dns.google) for the TXT record of the generated domain, verifies the response with an Ed25519 signature, and decrypts it with AES-ECB to obtain a payload URL (observed on Catbox, files.catbox.moe/z5zpy9.dat). It has three execution modes: injection into svchost.exe, dropping an EXE into a random temp folder with Zone.Identifier removed, or running a hidden PowerShell with execution-policy bypass. Its own host check expects wmpdmc.exe (hash 0x552751E3) and it uses the mutex Local\WindowsSecurity.

Observed payload: XMRig 6.26.0 injected into svchost.exe. It reaches an onion mining pool over a local Tor SOCKS5 proxy (lyrebird obfs4 bridges, Tor data under %TEMP%\torbundle\data), pauses mining while the user is active, and can load the WinRing0 driver to tune the CPU. Check Point notes the loader can deliver other payloads, so the impact is not limited to cryptojacking.

Evolution: an earlier variant from early June 2026 expected Cursor.exe as its host, persisted through a Startup-folder shortcut, used the domain suffix aber.ir, and included anti-debugging and VM-scoring checks that were later removed; its regional filtering started as Russia-only and was later expanded.

Attribution: Check Point reports only indirect indicators: Russian-language/CIS exclusions in the infection checks (Ukraine exempted), compilation timestamps and GitHub commits pointing to UTC-4 (commit timestamps appear inconsistent, which may be deliberate obfuscation), and three Outlook email addresses tied to the commits with different UTC offsets. There is no confirmed actor or nation-state attribution.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.004 Masquerading: Masquerade Task or Service; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497.003 Time Based Checks; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090.003 Proxy: Multi-hop Proxy; T1102.001 Web Service: Dead Drop Resolver; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1573.001 Encrypted Channel: Symmetric Cryptography

Impact

T1496.001 Resource Hijacking: Compute Hijacking

defense-impairment

T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

Resource Development

T1583.006 Web Services; T1608.006 SEO Poisoning

Discovery

T1614.001 System Location Discovery: System Language Discovery

Remediation for YobaLoader malware campaign

Immediate actions

• Hunt for C:\ProgramData\WMProcess, WMPDMC.exe outside System32 and wmpdui.dll or winmm.dll sitting beside non-system executables
• Hunt for Local System scheduled tasks that claim Microsoft authorship but launch binaries from ProgramData
• Block and alert on dedyn.io subdomains, files.catbox.moe downloads and t.me/yoba_fanclub access from non-browser processes
• Alert on DoH/dns.google TXT lookups and Tor or obfs4 bridge traffic from servers and workstations that have no business reason for them
• Isolate hosts showing svchost.exe with sustained high CPU and Tor child activity, then reimage

Workarounds

• Block outbound Tor and obfs4 bridge connections at the perimeter
• Remove the malicious scheduled task, the WMProcess folder and the injected miner process, and rotate any credentials used on affected hosts as a precaution

Longer-term hardening

• Restrict software installation to approved sources and block downloads of unverified GitHub release ZIPs for AI tools
• Treat a valid signature as insufficient when an unexpected DLL accompanies the executable; enforce application control (WDAC/AppLocker) with DLL rules
• Restrict or proxy DoH egress to approved resolvers
• Train users that official OpenAI and Anthropic desktop apps are distributed only through the vendors' own channels

Affected and fixed versions

• Microsoft — Windows (endpoints where users run the trojanized archives; technique abuse, not a vulnerability)

Timeline of YobaLoader malware campaign

• 2026-06-01 Early June 2026 (day approximate): earlier locked-ioc-24 variant expecting Cursor.exe as sideload host, with Startup-folder persistence and locked-ioc-29 domain suffix
• 2026-07-16 First fake GitHub repository created, per Check Point (repositories created around July 16-17)
• 2026-08-30 Malicious sol-setup.zip (GPT-5.6 Sol) uploaded to GitHub releases
• 2026-08-31 Malicious Setup-Claude.zip (Claude Opus) uploaded
• 2026-09-04 Malicious GPT-6-Astra-Setup.zip (GPT-6 Astra) uploaded
• 2026-10-08 One documented victim installation reported (per Gridinsoft)
• 2026-10-13 Simvay published an incident analysis of a fake GPT-6 Astra installer (per Gridinsoft)
• 2026-10-27 Check Point Research publicly disclosed the Yoba campaign after about two months of tracking; at least 703 downloads of the three archives counted
• 2026-11-01 Cloud Security Alliance published a research note on Yoba signed-binary sideloading
• 2026-11-07 GBHackers published coverage of the locked-ioc-26 campaign

Sources cited for YobaLoader malware campaign

• Check Point Research: Tricks from the Past Deployed via Signed ChatGPT and Claude Binaries Check Point Research · Research · 2026-10-27
• Check Point Blog: Yoba malware abuses signed ChatGPT and Claude binaries to target AI users Check Point · Vendor report · 2026-10-27
• Cloud Security Alliance: Yoba - Signed AI Vendor Binaries as Malware Sideloading Hosts labs.cloudsecurityalliance.org · Research · 2026-11-01
• Polyswarm: Yoba Malware Campaign Abuses Signed AI Applications to Evade Detection blog.polyswarm.io · Blog
• Gridinsoft: Yoba Fake AI Installers Hide a Miner Behind Signed Apps blog.gridinsoft.com · Blog
• aicybr: Yoba Malware - Fake ChatGPT and Claude Installers, DLL Sideloading and Detection aicybr.com · Blog
• GBHackers: Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware gbhackers.com · News · 2026-11-07
• The Hacker News: Fake ChatGPT and Claude Apps Abuse Signed Binaries The Hacker News · News
• CSO Online: Fake ChatGPT and Claude apps spread malware via signed AI binaries csoonline.com · News
• eSecurity Planet: Hackers Use Fake ChatGPT and Claude Downloads on GitHub to Spread Malware esecurityplanet.com · News

More in malware

• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)
• GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India