# YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig

> A campaign tracked by Check Point Research as "Yoba" distributes YobaDropper and YobaLoader through fake GitHub repositories and GitHub Pages sites advertising non-existent AI desktop apps ("GPT-5.6 Sol", "GPT-6 Astra", "Claude Opus"). Malicious ZIPs pair a legitimate signed Setup.exe with a malicious winmm.dll for DLL sideloading, and the observed final payload is the XMRig 6.26.0 miner routed over Tor.

- **Published:** 2026-11-07T09:58:26Z
- **Last reviewed:** 2026-11-07T09:58:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5503
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5503.png
- **ID:** TL-2026-5503
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Check Point Research (report "Tricks from the Past Deployed via Signed ChatGPT and Claude Binaries", 2026-10-27) tracks a Windows-focused campaign named Yoba. Operators created fake GitHub repositories and GitHub Pages sites (first repository around 2026-07-16) impersonating AI desktop applications that do not exist: GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The repositories were promoted through SEO poisoning and ranked high in Google search results. Malicious ZIP releases were uploaded between 2026-08-30 and 2026-09-04 (sol-setup.zip, Setup-Claude.zip, GPT-6-Astra-Setup.zip). Check Point counted at least 703 downloads of the three archives (269 GPT-5.6 Sol, 82 Claude Opus, 352 GPT-6 Astra) and states there is no indication that OpenAI, Anthropic, ChatGPT or Claude were compromised; the signed binaries are used only as sideloading hosts.

Stage 1 (YobaDropper): each archive contains a legitimately signed Setup.exe next to a malicious winmm.dll that spoofs the Windows multimedia library with 180 exports containing only return instructions; the malicious logic runs from the DLL entry point. The dropper validates the host process name with a DJB2 hash (expects Setup.exe, hash 0xE6C2F326). If validation fails it sleeps 200,000 times for 5.5 seconds (about 12.7 days) to stall sandboxes. It reads the keyboard layout and exits on Russian and CIS-region layouts (Ukrainian is exempted), and it requires administrator privileges. It then creates C:\ProgramData\WMProcess, copies the legitimate Windows binary WMPDMC.exe into it, decrypts an embedded payload with an XOR routine, writes it as wmpdui.dll, and registers a scheduled task running as Local System three minutes after boot. The task claims Microsoft Corporation authorship with a Windows Media Player device-metadata description. WMPDMC.exe then sideloads wmpdui.dll, which is YobaLoader.

Stage 2 (YobaLoader): the loader avoids dedicated C2 servers. It downloads the profile image of the Telegram channel t.me/yoba_fanclub and uses the last 50 bytes as a DGA seed, generating domains from adjective, noun, verb and number word lists under dedyn.io (example: calm-piano-floats-313.dedyn.io). Changing the channel photo retargets all infections without touching the binary. The loader queries the Google DoH resolver (dns.google) for the TXT record of the generated domain, verifies the response with an Ed25519 signature, and decrypts it with AES-ECB to obtain a payload URL (observed on Catbox, files.catbox.moe/z5zpy9.dat). It has three execution modes: injection into svchost.exe, dropping an EXE into a random temp folder with Zone.Identifier removed, or running a hidden PowerShell with execution-policy bypass. Its own host check expects wmpdmc.exe (hash 0x552751E3) and it uses the mutex Local\WindowsSecurity.

Observed payload: XMRig 6.26.0 injected into svchost.exe. It reaches an onion mining pool over a local Tor SOCKS5 proxy (lyrebird obfs4 bridges, Tor data under %TEMP%\torbundle\data), pauses mining while the user is active, and can load the WinRing0 driver to tune the CPU. Check Point notes the loader can deliver other payloads, so the impact is not limited to cryptojacking.

Evolution: an earlier variant from early June 2026 expected Cursor.exe as its host, persisted through a Startup-folder shortcut, used the domain suffix aber.ir, and included anti-debugging and VM-scoring checks that were later removed; its regional filtering started as Russia-only and was later expanded.

Attribution: Check Point reports only indirect indicators: Russian-language/CIS exclusions in the infection checks (Ukraine exempted), compilation timestamps and GitHub commits pointing to UTC-4 (commit timestamps appear inconsistent, which may be deliberate obfuscation), and three Outlook email addresses tied to the commits with different UTC offsets. There is no confirmed actor or nation-state attribution.

## MITRE ATT&CK

- T1583.006 Web Services
- T1608.006 SEO Poisoning
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1036.004 Masquerading: Masquerade Task or Service
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1497.003 Time Based Checks
- T1480 Execution Guardrails
- T1055 Process Injection
- T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1614.001 System Location Discovery: System Language Discovery
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1102.001 Web Service: Dead Drop Resolver
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1090.003 Proxy: Multi-hop Proxy
- T1496.001 Resource Hijacking: Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Splunk SPL)** (`TL-2026-5503-SPL-002`)

Detects YobaDropper persistence (TL-2026-5503): a scheduled task running as Local System three minutes after boot that launches a copy of WMPDMC.exe from C:\ProgramData\WMProcess while claiming Microsoft Corporation and a Windows Media Player description. The KQL and Sigma flavors also cover YobaLoader child activity: hidden PowerShell with execution-policy bypass and svchost.exe spawned as the XMRig injection host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1036.004, T1036.005, T1059.001, T1055
- **Data sources:** wineventlog, WinEventLog:Security (EventCode 4698), sysmon (EventCode 1)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 earliest=-24h@h) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\schtasks.exe" CommandLine="*/create*" earliest=-24h@h)
```YobaDropper persistence TL-2026-5503: Local System task three minutes after boot launching a copied WMPDMC.exe from ProgramData WMProcess while claiming Microsoft authorship```
| eval task_text=coalesce(Task_Content, TaskContent, CommandLine, Message)
| where match(task_text,"(?i)ProgramData\\\\WMProcess") OR match(task_text,"(?i)WMPDMC\\.exe")
| eval runs_as_system=if(match(task_text,"(?i)S-1-5-18|SYSTEM"),"yes","no")
| eval claims_microsoft=if(match(task_text,"(?i)Microsoft Corporation|Windows Media Player"),"yes","no")
| eval boot_trigger=if(match(task_text,"(?i)BootTrigger|onstart|PT3M"),"yes","no")
| eval creator=coalesce(Subject_Account_Name, User)
| stats count min(_time) as first_seen values(sourcetype) as sources values(runs_as_system) as runs_as_system values(claims_microsoft) as claims_microsoft values(boot_trigger) as boot_trigger values(creator) as creator values(task_text) as task_detail by host
| convert ctime(first_seen)
````

### Microsoft KQL

```kql
let lookback = 24h;
let task_events = DeviceEvents
    | where Timestamp > ago(lookback)
    | where ActionType == "ScheduledTaskCreated"
    | extend Detail = tostring(AdditionalFields)
    | where Detail has_any ("WMProcess", "WMPDMC.exe")
    | project Timestamp, DeviceName, Stage = "Scheduled task referencing WMProcess or WMPDMC.exe", Detail, Account = InitiatingProcessAccountName, Proc = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine;
let task_cli = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create" and ProcessCommandLine has_any ("WMProcess", "WMPDMC.exe")
    | project Timestamp, DeviceName, Stage = "schtasks /create for WMPDMC.exe persistence", Detail = ProcessCommandLine, Account = AccountName, Proc = InitiatingProcessFileName, CommandLine = ProcessCommandLine;
let relocated_host = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName =~ "WMPDMC.exe"
    | where not(FolderPath startswith @"C:\Windows\System32\" or FolderPath startswith @"C:\Program Files\Windows Media Player\" or FolderPath startswith @"C:\Program Files (x86)\Windows Media Player\")
    | project Timestamp, DeviceName, Stage = "WMPDMC.exe sideload host executing from non-system path", Detail = FolderPath, Account = AccountName, Proc = FileName, CommandLine = ProcessCommandLine;
let loader_children = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "WMPDMC.exe"
    | where (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "bypass" and ProcessCommandLine has "hidden")
        or FileName =~ "svchost.exe"
    | project Timestamp, DeviceName, Stage = iff(FileName =~ "svchost.exe", "YobaLoader child svchost.exe (injection host)", "YobaLoader hidden PowerShell with execution-policy bypass"), Detail = ProcessCommandLine, Account = AccountName, Proc = FileName, CommandLine = InitiatingProcessCommandLine;
union task_events, task_cli, relocated_host, loader_children
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Stages = make_set(Stage), StageCount = dcount(Stage), Details = make_set(Detail, 10), Accounts = make_set(Account, 5) by DeviceName
| order by StageCount desc, LastSeen desc
```

### Sigma

```yaml
title: YobaLoader Persistence via Relocated WMPDMC.exe and Masquerading Scheduled Task
id: 6f0c2a4e-5d1b-4b7a-9a31-5503a0000002
status: experimental
description: Detects Yoba post-exploitation behaviour (TL-2026-5503). WMPDMC.exe executing outside the Windows Media Player locations, schtasks.exe creating a task that points at ProgramData WMProcess or WMPDMC.exe, WMPDMC.exe spawning hidden PowerShell with execution-policy bypass, or WMPDMC.exe spawning svchost.exe as an injection host for the XMRig payload.
references:
    - https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-evasion
    - attack.t1053.005
    - attack.t1036.004
    - attack.t1036.005
    - attack.t1059.001
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection_relocated_host:
        Image|endswith: '\WMPDMC.exe'
    filter_legit_locations:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Program Files\Windows Media Player\'
            - 'C:\Program Files (x86)\Windows Media Player\'
    selection_task_tool:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_task_target:
        CommandLine|contains:
            - 'WMProcess'
            - 'WMPDMC.exe'
    selection_ps_child:
        ParentImage|endswith: '\WMPDMC.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'bypass'
            - 'hidden'
    selection_svchost_child:
        ParentImage|endswith: '\WMPDMC.exe'
        Image|endswith: '\svchost.exe'
    condition: (selection_relocated_host and not filter_legit_locations) or (selection_task_tool and selection_task_target) or selection_ps_child or selection_svchost_child
falsepositives:
    - Administrators staging a copy of WMPDMC.exe for troubleshooting
    - Software deployment tools that create scheduled tasks referencing Windows Media Player components
level: high

```

**Known false positives:**

- Administrators or deployment tools creating scheduled tasks that reference Windows Media Player components
- Legitimate software that parents svchost.exe and PowerShell from a copied system binary during troubleshooting

**Tuning notes:** Enable audit of Other Object Access Events so Security 4698 is generated. The exact task name is not published, so detection keys on the WMProcess path and WMPDMC.exe. Exclude known management accounts and deployment tools; confirm task XML field names (Task_Content) in your Splunk Windows TA version.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Sigma) (locked: unlock with TL Creds)
- Yoba Masquerading Local System Scheduled Task Launching Relocated WMPDMC.exe (Sigma) (locked: unlock with TL Creds)
- Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Sigma) (locked: unlock with TL Creds)
- Yoba DLL Sideloading via Signed Setup.exe ([indicator]) and WMPDMC.exe ([indicator]) (Splunk SPL) (locked: unlock with TL Creds)
- Yoba YobaLoader Telegram-Seeded DGA, DoH TXT Resolution, Catbox Payload and Tor Bridge Traffic (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `51.89.228[.]250`
- Domain: `dedyn[.]io`
- URL: `hxxps://files[.]catbox[.]moe/z5zpy9.dat`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Check Point Research: Tricks from the Past Deployed via Signed ChatGPT and Claude Binaries](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/)
- [Check Point Blog: Yoba malware abuses signed ChatGPT and Claude binaries to target AI users](https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/)
- [GBHackers: Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware](https://gbhackers.com/yobaloader-malware/)
- [The Hacker News: Fake ChatGPT and Claude Apps Abuse Signed Binaries](https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html)
- [Polyswarm: Yoba Malware Campaign Abuses Signed AI Applications to Evade Detection](https://blog.polyswarm.io/yoba-malware-campaign-abuses-signed-ai-applications-to-evade-detection)
- [Cloud Security Alliance: Yoba - Signed AI Vendor Binaries as Malware Sideloading Hosts](https://labs.cloudsecurityalliance.org/research/csa-research-note-yoba-signed-ai-binary-sideloading-20261101/)
- [Gridinsoft: Yoba Fake AI Installers Hide a Miner Behind Signed Apps](https://blog.gridinsoft.com/yoba-fake-ai-installers-signed-apps/)
- [aicybr: Yoba Malware - Fake ChatGPT and Claude Installers, DLL Sideloading and Detection](https://aicybr.com/blog/yoba-malware-fake-chatgpt-claude-signed-dll-sideloading-detection)
- [CSO Online: Fake ChatGPT and Claude apps spread malware via signed AI binaries](https://csoonline.com/article/4241634/fake-chatgpt-claude-apps-spread-malware-via-signed-ai-binaries.html)
- [eSecurity Planet: Hackers Use Fake ChatGPT and Claude Downloads on GitHub to Spread Malware](https://www.esecurityplanet.com/news/news-chatgpt-claude-github-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5503