Hackers Abuse Signed ChatGPT and Claude Applications to Deploy Yoba Malware and Evade Detection

Hackers are distributing Yoba malware through fake ChatGPT and Claude downloads, pairing legitimate, digitally signed applications with malicious libraries.

The campaign uses trusted software and GitHub hosting to make dangerous installers appear credible, ultimately deploying a cryptocurrency miner on compromised Windows computers.

The attack does not require compromising OpenAI or Anthropic. Instead, criminals place malicious files beside authentic executables and exploit how those programs load supporting libraries.

A valid signature protects the signed executable’s integrity, but it does not guarantee that neighboring files are safe.

Analysts from PolySwarm noted in their November 2 threat report that Yoba combines signed application abuse, environmental checks, and layered payload delivery.

Their assessment draws on Check Point Research’s investigation, which tracked fraudulent AI repositories for approximately two months.

Hackers Abuse Signed ChatGPT and Claude Applications

Attackers created GitHub repositories and GitHub Pages websites advertising supposed desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.

Visitors were directed to ZIP archives distributed through GitHub releases. Earlier reporting on fake GitHub AI downloads describes the same campaign’s use of familiar branding to encourage installation.

Researchers traced repositories to July 2026, with malicious releases appearing in late August and early September. Some projects ranked prominently in Google searches despite showing no artificially inflated stars or forks.

Check Point assessed that search visibility likely involved SEO poisoning, rather than confirming how rankings were manipulated. Inside the archives, a genuine signed installer loads YobaDropper through DLL sideloading.

The malicious library exposes 180 functions to resemble a Windows multimedia component, but its harmful logic runs from its entry point. Related signed software sideloading attacks show how this technique extends beyond AI-themed lures.

Before continuing, YobaDropper checks its host executable’s name. A mismatch triggers 200,000 sleep cycles lasting 5.5 seconds each, delaying execution beyond many automated analysis windows.

It also filters keyboard layouts, excluding Russian, Belarusian, Armenian, Azerbaijani, Kazakh, and other language environments while explicitly exempting Ukrainian. Administrator privileges are required to proceed.

The dropper then copies a legitimate Windows Media Player component into a ProgramData directory and decrypts another malicious library.

A scheduled task running as Local System launches the copied executable after a three-minute startup delay. Microsoft-themed task details help disguise this second sideloading stage, which activates YobaLoader.

Telegram Tasking, XMRig Mining, and Detection Priorities

YobaLoader retrieves a Telegram channel’s profile image and feeds its final 50 bytes into a domain generation algorithm. Changing that image changes the generated domain, allowing operators to redirect the infection chain without rebuilding the malware.

The loader queries Google’s DNS-over-HTTPS service for a TXT record, validates returned instructions using Ed25519 signatures, and decrypts them using AES in ECB mode.

It then downloads an encrypted payload from hosting services such as Catbox. Separately documented hidden XMRig mining campaigns illustrate how DNS records and image content can support concealed delivery chains.

Researchers observed XMRig 6.26.0 injected into a Windows service process. Mining traffic passed through a local Tor SOCKS5 proxy, while activity monitoring paused mining during computer use.

YobaLoader also supports executable and hidden PowerShell payloads, although information theft and ransomware deployment were not documented.

Defenders should investigate unexpected DLL loads, Microsoft-themed scheduled tasks, and Windows executables running from unusual directories. Reviewing complete execution chains matters more than trusting signatures alone; the observed miner is only one payload this loader can deliver.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Abuse Signed ChatGPT and Claude Applications to Deploy Yoba Malware and Evade Detection appeared first on Cyber Security News.