Threat intel

Fake ChatGPT and Claude desktop apps hide Yoba miner

By Yaali. November 2, 2026, 6 min read, Threat intel, AI security, Windows.

Fake GitHub pages for GPT-5.6 Sol, GPT-6 Astra and Claude Opus sideload Yoba malware behind signed installers. How it works and how to check your PCs.

Check Point Research disclosed a campaign on October 27 that it calls Yoba. The operator built GitHub repositories and GitHub Pages sites for desktop apps named "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus", and pushed them up Google results with SEO poisoning (gaming search rankings) rather than fake stars or forks. The ZIP downloads contain a real installer signed by OpenAI or Anthropic and a malicious DLL beside it. The chain ends with the XMRig cryptocurrency miner running inside a Windows process.

Anyone on Windows who searched for a desktop build of ChatGPT or Claude and ran a download from GitHub since late August is a candidate. The miner is the payload today, but the loader in the middle runs any executable or PowerShell script its operator sends, so Check Point advises treating an infection as a wider compromise. Check Point found no sign that OpenAI or Anthropic were themselves breached; the signed files are genuine and only their neighbour is malicious.

How it works

The first repository dates from July 16, 2026. Malicious ZIP releases followed on August 30 (GPT-5.6 Sol), August 31 (Claude Opus) and September 4 (GPT-6 Astra). The archives are not password protected, which is unusual for malware and suggests the operator trusted the signed file to carry it past scanners.

When the user runs Setup.exe, Windows looks for winmm.dll, a standard multimedia library, and checks the program's own folder before System32. The attacker's winmm.dll sits in that folder, so the signed installer loads it. This is DLL sideloading: the executable is untouched and keeps its valid signature, while the code that runs belongs to the attacker. Check Point calls this first stage YobaDropper.

YobaDropper hashes the name of the process that loaded it and only continues if that name is Setup.exe. A sandbox that runs the DLL on its own fails the check, and instead of exiting the DLL calls Sleep for 5.5 seconds 200,000 times, about 12.73 days, which outlasts any automated analysis. It then reads the keyboard layout and stops on systems set to one of 11 languages: Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek or Tatar. Ukrainian is not on the list.

The dropper needs administrator rights. Without them it shows "Please run this program as Administrator." and quits, so a user without local admin rights stops the chain here. With them, it creates C:\ProgramData\WMProcess\, copies the genuine WMPDMC.exe (a Windows Media Player component) from System32 into it, and writes the second stage next to it as wmpdui.dll. A scheduled task with "Microsoft Corporation" as author and a description about Windows Media Player metadata starts that copy as Local System three minutes after every boot. The same sideloading trick then loads the second stage.

How the loader finds its server

The second stage, YobaLoader, only runs inside WMPDMC.exe. It opens the public Telegram channel t.me/yoba_fanclub, downloads the channel's profile picture and uses the last 50 bytes of that image as the seed for a domain generator. The output looks like adjective-noun-verb-123.dedyn.io. To move the malware to a new domain, the operator only has to change a profile picture.

The loader asks Google's DNS over HTTPS service (dns.google) for a TXT record on that domain. DNS over HTTPS sends the lookup inside ordinary HTTPS traffic, so the company resolver never sees the generated name. The record is signed and encrypted; once verified and decrypted it holds a link to a file on Catbox, a public file host. A leading digit picks how the file runs: injected into svchost.exe, saved as an executable in %TEMP% with its Zone.Identifier mark (the "downloaded from the internet" flag) removed, or run as a hidden PowerShell script.

What attackers are doing

In the wave Check Point analysed, the payload is XMRig 6.26.0, injected into svchost.exe. It mines through a bundled Tor 0.4.9.12 client with the lyrebird 0.8.1 bridge transport, connecting to an onion mining pool over TLS through a local SOCKS5 proxy. It uses about 85% of CPU threads, pauses while the user is active and resumes after 240 seconds idle, so the person at the keyboard rarely notices. It can also load the WinRing0 driver to tune the processor for mining.

The campaign is older than the AI lures. An early June 2026 version sideloaded through a file named Cursor.exe, suggesting a fake Cursor coding tool, persisted through a Startup folder shortcut, excluded only Russian keyboards and used .aber.ir domains. It used the same Telegram channel and image. Check Point assesses the operator may be of Russian origin and mostly works in UTC-4, an assessment rather than a firm attribution. Each repository was registered with a different email address and showed a different time zone.

What to do

There is no patch, because nothing is vulnerable. The fix is to find infected machines, clean them, and stop users running unvetted installers with admin rights.

1. Check endpoints for the persistence. Look for the folder C:\ProgramData\WMProcess\ and any WMPDMC.exe or wmpdui.dll outside C:\Windows\System32. In PowerShell, Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*WMProcess*' } lists the fake task. In your EDR (endpoint detection and response) tool, search for WMPDMC.exe running from ProgramData, and for a winmm.dll loaded from a Downloads or extracted ZIP folder next to a Setup.exe.
2. Hunt the network side. Look in proxy logs for requests to t.me/yoba_fanclub, to dns.google/resolve from anything other than a browser, and to files.catbox.moe. Sustained high CPU on idle machines, and Tor traffic from desktops, are worth chasing too. Check Point's report lists file hashes, the Tor bridge addresses and the repository URLs for your EDR and firewall.
3. Contain before you clean. Block files.catbox.moe and Tor at the edge, and stop desktops from using public DNS over HTTPS so lookups go through your resolver. Be careful with dedyn.io itself: it is a legitimate dynamic DNS service, so alert on new subdomains rather than block it outright unless you know nobody uses it.
4. Rebuild infected hosts. Deleting the task and folder removes the miner's foothold, but the loader can run any program or script, and you cannot easily prove what else it fetched. Reimage the machine and, as a precaution, rotate passwords and tokens used on it, including AI tool sessions.
5. Close the entry point. The dropper quits without admin rights, so removing local administrator rights from everyday accounts would have stopped this chain. Add application control (App Control for Business or AppLocker) rules that block executables run from user Downloads and temp folders, and tell staff where the real desktop apps come from: the vendor's own website or your software portal, never a GitHub project with a model name in its title.

Why signature checks miss this

Many teams treat a valid OpenAI, Anthropic or Microsoft signature as enough to let a process run. Yoba uses two signed binaries in a row, the vendor installer and Windows' own WMPDMC.exe, and neither is modified. Detection has to look at where a binary runs from and which DLLs it loads, because the signature check passes every time.

Our security operations team hunts for sideloaded DLLs and fake scheduled tasks like these, and our safeguarding and hardening work sets up the admin rights and application control rules that stop them. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Check Point Research, Tricks from the past deployed via signed ChatGPT and Claude binaries, Check Point blog, Help Net Security, Security Affairs, eSecurity Planet.