Check Point Research has documented a malware campaign, which it calls Yoba, that pairs genuine digitally signed OpenAI and Anthropic executables with a malicious library to install an XMRig cryptocurrency miner. The operators advertised nonexistent desktop apps through fake GitHub pages, and the researchers counted at least 703 downloads of the three malicious archives.
Fake GitHub Pages Advertising GPT-5.6 Sol, GPT-6 Astra and Claude Opus 5 Free
The campaign relied on fake GitHub repositories and GitHub Pages sites, boosted by search engine poisoning, to promote desktop apps that do not exist. The lures were named GPT-5.6 Sol, GPT-6 Astra and Claude Opus 5 Free. An earlier wave in June impersonated the Cursor AI coding agent. Check Point says the fake repositories were created in July.
Between August 30 and September 4, the operators uploaded three unencrypted ZIP archives to GitHub Releases. Downloads totaled 703: 269 for GPT-5.6 Sol, 82 for Claude Opus and 352 for GPT-6 Astra.
How YobaDropper and YobaLoader Deliver the Miner
Each archive contains a real, digitally signed OpenAI or Anthropic executable renamed Setup.exe, next to a malicious file named winmm.dll. When the user runs the signed program, Windows loads the malicious winmm.dll in a technique known as DLL sideloading. That library, called YobaDropper by Check Point, loads YobaLoader.
Telegram and Google DNS-over-HTTPS for Instructions
YobaLoader obtains its instructions through Telegram and through Google DNS-over-HTTPS, and then injects an XMRig miner. Using a legitimate messaging service and a major public DNS resolver for command retrieval means the traffic blends into ordinary activity on the infected host.
The Signed Executable as Cover
The signed vendor binary is the core of the lure. Because the executable carries a valid signature, the file that starts the infection chain appears legitimate to the user and to tools that check signatures. The malicious component is the sideloaded library, a separate file that the signature does not cover.
Attribution Clues Pointing to a Russian-Speaking Developer
Check Point found no connection to a known threat group. Several clues point to a Russian-speaking developer working in the UTC-4 time zone, based on compile timestamps. The operators also run a Russian meme Telegram channel, and the malware skips machines that use a Russian keyboard layout or any of 10 other CIS keyboard layouts. Those clues suggest an individual or small team, though the researchers stop short of naming anyone.
What the Yoba Campaign Shows About AI Brand Impersonation
The choice of lures follows public interest in new AI models. Product names such as GPT-6 Astra and Claude Opus 5 Free mimic the naming of real releases, so a user searching for the newest model may not recognize that the app does not exist. The same operators ran an earlier wave themed on Cursor, which shows that the approach moved from one popular AI product to the next.
The 703 downloads are a low number by the standards of large malware campaigns, and the payload is a cryptominer instead of a credential stealer or ransomware. Even so, the technique is more notable than the result. Packaging a real signed executable with a hostile library is cheap, reusable and hard for a user to catch, and nothing prevents the same package from carrying a more damaging payload later.
Check Point has published indicators of compromise, and its guidance is to download AI applications only from official vendor sites. The report does not say how many of the 703 downloads led to a running miner, so the actual infection count is unknown.
The download figures show how the lures performed. The Claude Opus archive drew 82 downloads, the GPT-5.6 Sol archive 269, and the GPT-6 Astra archive 352, so the fake app with the newest-sounding name attracted the most victims. Check Point’s report places the activity between July and September, with the report itself coming weeks after the last archive upload on September 4, which suggests the repositories were live long enough to be found through search results.
