Cybersecurity Alert: Malicious Software Distribution via Fake AI Applications
In a concerning revelation, attackers have been found exploiting counterfeit versions of ChatGPT and Claude desktop applications hosted on GitHub to disseminate a sophisticated malware chain. This strategy utilizes legitimate signed binaries, allowing the malicious software to bypass existing security measures effectively. The details of this alarming campaign, dubbed "Yoba," were documented in research published by Check Point on October 27.
The research outlines that the Yoba campaign has been under scrutiny for a duration of two months, although it points out an earlier variant identified as posing as the Cursor coding agent, which surfaced as far back as early June. The fraudulent projects have impersonated well-known artificial intelligence (AI) applications, including names like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.
Methodology of Distribution
The counterfeit applications primarily resided in GitHub repositories that featured GitHub Pages landing pages. Notably, some of these repositories appeared among the top search results on Google, likely due to a method known as search engine optimization (SEO) poisoning. This practice enables malicious actors to leverage SEO techniques to enhance the visibility of their content, ultimately facilitating wider distribution of illicit software.
Malicious Mechanisms at Play
A key feature of the Yoba campaign is its use of signed binaries to disguise malicious components. The fake AI applications incorporated genuine signed executables from OpenAI and Anthropic, accompanied by a harmful dynamic link library (DLL). According to Check Point, these signed Setup.exe files were instrumental in loading the malicious component through a technique known as DLL sideloading, a method frequently utilized to circumvent security protections.
The DLL in question, identified as "YobaDropper," was programmed to execute multiple preliminary checks before deploying a second-stage loader. These checks included assessing the name of the host process and determining whether the process had administrative privileges. Additionally, it inspected keyboard layouts to avoid detection on machines in Commonwealth of Independent States (CIS) countries, excluding Ukraine. To further complicate automated analysis, the malicious agent employed lengthy sleep commands.
Check Point noted that the characteristics of the attack displayed indicators suggesting a Russian origin, raising further security concerns regarding the motives behind the operation.
Establishing Persistence
Once executed, the YobaDropper initiated a series of actions designed to establish persistence on infected systems. It created a directory within the ProgramData section, copied a legitimate Windows executable into this new folder, and then employed Windows Scheduled Tasks to ensure longevity. This task ran under the Local System account while masquerading as a legitimate Microsoft task, enhancing its chances of evading detection.
The Role of YobaLoader
In its second stage, the malware utilized a distinct component referred to as YobaLoader. This element relied on Telegram and encrypted Domain Name System (DNS) queries, specifically DNS-over-HTTPS (DoH), to obtain its instructions without the need for a dedicated command-and-control (C2) infrastructure.
To carry out these operations, the YobaLoader captured images from a Telegram channel and generated domains using data derived from these images via a domain generation algorithm. Further, it queried Google’s DoH service to access encrypted data stored in DNS records, validating this information cryptographically before proceeding to retrieve and decrypt its next-stage payload.
Cautions and Recommendations
In light of these findings, Check Point has issued a strong advisory urging organizations to exercise caution when installing AI applications sourced from unverified repositories. They recommend implementing restrictions on the execution of software from unknown origins to mitigate the risks posed by such malware campaigns.
While the observed payload from the YobaLoader was an XMRig cryptominer, researchers caution that this loader is versatile and could potentially be utilized to deliver other executable files or PowerShell payloads in future attacks. As cyber threats evolve, awareness and proactive measures remain vital for ensuring digital security.