Cybersecurity researchers have uncovered a malware campaign, known as Yoba, that uses fake desktop applications for ChatGPT and Claude to trick users into installing cryptocurrency-mining malware. The attackers created convincing GitHub projects and websites for supposed AI tools such as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus,” then distributed malicious ZIP files that appeared to be legitimate installers. According to Check Point Research, the campaign exploits public interest in AI tools and the trust people place in familiar technology brands.
The malicious archives contain two key files: a genuine, digitally signed executable from OpenAI or Anthropic, and a harmful Windows DLL named winmm.dll. When a user runs the legitimate-looking Setup.exe, Windows loads the malicious DLL alongside it. This technique, called DLL sideloading, lets attackers abuse trusted signed software to make malicious code appear less suspicious and evade basic security checks. Importantly, the research does not suggest that OpenAI, Anthropic, ChatGPT, or Claude themselves were compromised.
Once launched, the malicious DLL—called YobaDropper—checks that it is being run through the expected host executable, making it harder for researchers to activate it in a sandbox. It then copies a legitimate Windows media component, wmpdmc.exe, into a new folder and places another malicious DLL beside it. This second component, YobaLoader, establishes persistence through a scheduled task and retrieves further instructions from the attacker.
YobaLoader uses an unusual command-and-control method to avoid detection. It downloads an image from a Telegram channel, takes the final 50 bytes as a seed, and generates a new domain using a domain-generation algorithm. It then queries Google’s DNS-over-HTTPS service for a hidden command stored in a DNS TXT record, which leads it to download the next-stage payload. By using DoH and common file-hosting services, the attackers make their traffic resemble ordinary internet activity and evade passive DNS monitoring.
The downloaded payload is injected into Windows’ svchost.exe process, where it launches XMRig, a cryptocurrency miner. Victims may notice slower performance, higher CPU usage, increased electricity consumption, or unexpected system heat. Users should download AI applications only from official vendor websites or verified app stores, avoid installing “desktop versions” from random GitHub repositories, and be cautious of search results promoting unfamiliar AI tools. Organizations should also restrict installations from unknown sources and monitor endpoints for unusual scheduled tasks and mining activity.
Read the original article: