Yoba
Latest
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Fake ChatGPT and Claude applications distributed via GitHub are delivering the Yoba malware. The samples use signed executables to load a cryptominer on infected systems.
Yoba malware spread through fake ChatGPT and Claude downloads using signed apps
Attackers hosted fake GitHub repositories and pages advertising ChatGPT and Claude desktop apps, delivering ZIP archives that sideload the Yoba malware family via a genuine signed installer. The malware then uses a loader that fetches instructions over DNS and deploys an XMRig cryptocurrency miner, with Check Point Research tracking the campaign for about two months. OpenAI and Anthropic were not compromised.
Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.