Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
MALWAREAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Check Point Research describes the Yoba chain: fake GitHub projects impersonating OpenAI and Anthropic apps deliver ZIPs containing a signed Setup.exe and a malicious winmm.dll (DLL sideloading). YobaDropper checks the parent process name, requires administrator rights, and persists via a scheduled task masquerading as Microsoft with WMPDMC.exe in C:\ProgramData\WMProcess. YobaLoader resolves its payload through a Telegram profile picture seed, a DoH TXT record and Catbox, and injects an XMRig 6.26.0 miner into svchost.exe over Tor 0.4.9.12 and lyrebird 0.8.1. No CVEs are identified.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Only download AI tools from official vendor sites rather than GitHub repositories or search-result links.
- Check endpoints for a WMProcess folder under ProgramData, a copy of WMPDMC.exe, or a wmpdui.dll file.
- Review scheduled tasks for entries authored as Microsoft Corporation that launch WMPDMC.exe three minutes after boot.
- Investigate any unexpected Tor activity or sustained high CPU usage that could indicate cryptocurrency mining.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Security Affairs