Cybersecurity researchers have uncovered a sophisticated scheme where cybercriminals are exploiting the rising popularity of artificial intelligence (AI) tools to distribute malware disguised as fake desktop applications. This alarming trend involves counterfeit software that impersonates well-known AI platforms, specifically ChatGPT and Claude. The research, conducted by Check Point Research, has identified this malicious campaign under the name Yoba.
The Yoba campaign relies heavily on false GitHub repositories that promote fictitious AI applications with names such as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus.” These deceptive projects manage to secure prominent placement in Google search results through a method known as SEO poisoning. This technique effectively directs unsuspecting users to download ZIP files containing both legitimate executables from reputable firms like OpenAI and Anthropic, as well as malicious components designed to compromise the users’ systems.
A significant aspect of this attack’s methodology is a technique known as DLL sideloading. This approach allows authenticated applications to inadvertently load harmful dynamic-link libraries (DLLs) located in the same directory. Essentially, when victims execute the seemingly genuine Setup.exe files provided by OpenAI or Anthropic, their systems automatically engage a malicious file known as winmm.dll. This malicious component, identified as YobaDropper by Check Point, is engineered with anti-analysis features. Notably, it includes a delay mechanism of up to 12 days that only allows execution if the process is initiated by a file named Setup.exe. Additionally, the malware performs checks that target specific keyboard layouts, effectively filtering out systems utilizing Russian, Belarusian, Kazakh, or other configurations commonly associated with the CI region.
Once the malware secures administrator rights on a compromised system, it exhibits advanced persistence techniques. This involves copying a legitimate Windows Media Player binary to the ProgramData folder while simultaneously placing a malicious DLL alongside it. Following this, the malware creates a scheduled task that misrepresents its author as Microsoft Corporation, executing with Local System privileges three minutes post-boot. The loader component, referred to as YobaLoader, introduces an extra layer of complexity by using a Telegram channel alongside image generation to create a domain name. Subsequently, it queries Google’s DNS-over-HTTPS service for encrypted instructions, further retrieving payload data from the Catbox file-hosting service.
The final payload observed in this campaign comprises XMRig cryptocurrency miners, which are configured to direct traffic through the Tor network and pause their activities during user engagement. However, security researchers caution that the loader’s capabilities extend beyond mere cryptomining; it possesses the potential to download various other Windows executables and PowerShell scripts, expanding the ramifications for compromised systems.
One of the most concerning elements of this attack is the use of legitimate online services for command and control operations, complicating detection efforts. Individual connections from these services might appear innocuous when analyzed in isolation. Consequently, cybersecurity experts emphasize several indicators of compromise to monitor, including unexpected DLL loading by signed applications, the initiation of scheduled tasks that launch duplicated system binaries, as well as execution practices originating from the ProgramData folder, and unusual network interactions.
To mitigate these risks, organizations are urged to reevaluate the permanent local administrator privileges assigned to developer workstations. Additionally, it is essential to enhance application controls beyond just monitoring executable signatures; there is an urgent need to scrutinize DLL loading behaviors as well. Authorities recommend that enterprises adopt a more nuanced approach to AI tools. Rather than enacting blanket bans that may inadvertently encourage shadow IT practices, companies should streamline the approval processes for legitimate AI applications, all while keeping an eye out for any suspicious execution patterns.
Given the specifics of this campaign, it poses a heightened risk to developer environments that typically manage sensitive assets such as source code, API keys, cloud credentials, and access to internal infrastructure. Therefore, a proactive and informed response is crucial in safeguarding against these evolving threats in the AI landscape.