Security researchers at Check Point uncovered a malware campaign that disguises malicious downloads as AI desktop applications and abuses legitimate signed OpenAI and Anthropic executables to load attacker-controlled DLLs.
Threat actors are distributing malware through fake AI software projects that use legitimate signed ChatGPT and Claude executables to load malicious code, according to new research from Check Point.
The campaign tracked as Yoba uses GitHub repositories and GitHub Pages sites masquerading as downloads for AI products including GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point said some of the pages appeared prominently in Google results, suggesting the operators were using search engine optimization techniques to attract victims.
The downloaded archives contain legitimate digitally signed executables from OpenAI or Anthropic alongside a malicious DLL. When the legitimate application starts, Windows loads the attacker-controlled DLL through a technique known as DLL sideloading.
Because the initial executable itself carries a legitimate software vendor’s signature, the approach can make the package appear more trustworthy to users and complicate simple reputation-based security checks.
Yoba uses multiple layers to avoid detection
Check Point calls the first malicious component YobaDropper. The malware performs anti-analysis checks, including verifying the process that loaded it and delaying execution under certain conditions. It also checks the victim’s keyboard configuration and excludes multiple countries in the Commonwealth of Independent States while making an explicit exception for Ukrainian systems.
After deployment, a second component called YobaLoader retrieves additional instructions and payloads. Rather than depending on a conventional dedicated command-and-control server, the operators use services including Telegram, DNS over HTTPS and public file hosting.
Researchers found that the malware could derive changing domains from data associated with a Telegram channel and obtain signed commands through DNS TXT records queried using Google’s DNS-over-HTTPS service.
The final payload observed by Check Point was an XMRig cryptocurrency miner configured to communicate through Tor. The researchers cautioned that the loader is not limited to cryptocurrency mining and can retrieve other executable or PowerShell payloads if the operators change their instructions.
Check Point said it had been monitoring the campaign for roughly two months and found evidence of an earlier Yoba variant dating to June 2026. The research illustrates how attackers can combine familiar DLL sideloading techniques with popular AI product names and trusted software infrastructure to improve the credibility of malware delivery campaigns.
Leave a Reply