Signed AI app campaign delivers Yoba malware and evades detection

Fake ChatGPT and Claude downloads are being used to distribute Yoba malware through legitimate, digitally signed applications paired with malicious libraries. The campaign uses trusted software and GitHub hosting to make the installers look credible, and it ends with a cryptocurrency miner running on compromised Windows computers.

Signed installers mask Yoba’s delivery chain

The attack does not require compromising OpenAI or Anthropic. Instead, criminals place malicious files beside authentic executables and rely on the way those programs load supporting libraries. A valid signature protects the signed executable’s integrity, but it does not guarantee that neighboring files are safe.

Analysts at PolySwarm said in a November 2 threat report that Yoba combines signed application abuse, environmental checks, and layered payload delivery. Their assessment draws on Check Point Research’s investigation, which tracked fraudulent AI repositories for about two months. The repositories used GitHub pages and GitHub releases to advertise desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.

Search traffic and archive contents pointed to a staged setup. Researchers traced the repositories to July 2026, and malicious releases appeared in late August and early September. Some projects ranked highly in Google search results even though they showed no artificially inflated stars or forks. Check Point assessed that search visibility likely involved SEO poisoning, rather than confirming how the rankings were manipulated.

YobaDropper and the host checks it performs

Inside the archives, a genuine signed installer loads YobaDropper through DLL sideloading. The malicious library exposes 180 functions so it looks like a Windows multimedia component, while its harmful code runs from the entry point. Before continuing, YobaDropper checks the name of its host executable.

If the name does not match, the dropper triggers 200,000 sleep cycles of 5.5 seconds each. That delay pushes execution past many automated analysis windows. It also checks keyboard layouts and excludes Russian, Belarusian, Armenian, Azerbaijani, Kazakh, and other language environments while explicitly exempting Ukrainian. Administrator privileges are required before the next stage can run.

The dropper then copies a legitimate Windows Media Player component into a ProgramData directory and decrypts another malicious library. A scheduled task running as Local System launches the copied executable after a three-minute startup delay. Microsoft-themed task details are used to disguise this second sideloading stage, which activates YobaLoader.

Telegram, DNS, and encrypted payload delivery

YobaLoader retrieves a Telegram channel profile image and uses its final 50 bytes in a domain generation algorithm. Changing that image changes the generated domain, which lets operators redirect the infection chain without rebuilding the malware. The loader then queries Google’s DNS-over-HTTPS service for a TXT record, validates the returned instructions with Ed25519 signatures, and decrypts them with AES in ECB mode.

It downloads an encrypted payload from hosting services such as Catbox. Researchers observed XMRig 6.26.0 injected into a Windows service process. Mining traffic passed through a local Tor SOCKS5 proxy, and activity monitoring paused mining when the computer was in use. YobaLoader also supports executable and hidden PowerShell payloads, although information theft and ransomware deployment were not documented.

Detection priorities and indicators

Defenders should look for unexpected DLL loads, Microsoft-themed scheduled tasks, and Windows executables running from unusual directories. Reviewing complete execution chains matters more than trusting signatures alone. The observed miner is only one payload this loader can deliver.

The investigation also listed indicators of compromise.

Component	SHA-256
YobaDropper	2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1c
YobaDropper	e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221
YobaDropper	2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4
YobaDropper	8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739
YobaDropper	73076c366edd5b8b351f04725663d2189a92dfdc93cc34740a61a1de9bbde51e
YobaDropper	b29cbf1bdde86ab15b5789e30dab7ce74c14ffd98f9d7e8b4f9887000e6d6834
YobaLoader	715e3ae134195f89d8da82ec4cbe6ba1d596d756a2c207a95f75a94afcdff3a4
YobaLoader	7a9d66a4637ee2a1ee1e82cfa5db91f720b757aa8fe1457e0807b1f2210b308e
YobaLoader	4d75c5461b65a2944b12414f1e5ef301fe411c1968788134d90aaaa6a50e68dd

Artifact	Investigation context
winmm.dll	Initial malicious sideloaded library
wmpdui.dll	Second-stage malicious library
WMProcess	Directory created under ProgramData
Setup.exe	Legitimate signed installer abused
WMPDMC.exe	Legitimate Windows executable copied
Cursor.exe	Earlier variant’s expected host
dedyn[.]io	Shared dynamic DNS service
svchost.exe	Observed payload injection target
Zone.Identifier	Origin metadata removed before execution