Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
MALWAREAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Only download AI tools from official vendor sites rather than GitHub repositories or search-result links.
- Check endpoints for a WMProcess folder under ProgramData, a copy of WMPDMC.exe, or a wmpdui.dll file.
- Review scheduled tasks for entries authored as Microsoft Corporation that launch WMPDMC.exe three minutes after boot.
- Investigate any unexpected Tor activity or sustained high CPU usage that could indicate cryptocurrency mining.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Security Affairs