Check Point Research discloses two-month Yoba campaign impersonating OpenAI and Anthropic

Check Point Research disclosed on Oct. 30, 2026, that it tracked a campaign called Yoba running for two months and spreading fake desktop software that impersonates OpenAI and Anthropic products via fraudulent GitHub projects.

The researchers said adversaries created fraudulent GitHub projects presenting themselves as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus applications. These repositories display no artificially inflated stars or forks yet show up in leading Google search results because of SEO poisoning. The first repository surfaced around July 2026, followed by malicious releases on August 30 and 31 and September 4, 2026. “These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims,” Check Point Research said.

Every ZIP archive contains a legitimate signed OpenAI or Anthropic Setup.exe bundled with a malicious winmm.dll file. Check Point Research said YobaDropper employs DLL sideloading, a method in which a trusted application loads a malicious library, and computes a hash of its launching program name, continuing only for Setup.exe. The archives carried no password protection and showed low detection rates owing to anti-sandbox techniques.

The process pauses for 5.5 seconds 200,000 times when sandbox checks fail, accumulating about 12.73 days. YobaDropper also stops when administrator privileges are absent and demands that the victim restart it with elevated rights. The malicious software blocks Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Tatar keyboard layouts, though Ukraine does not appear on that list.

Check Point Research believes the attackers might have Russian origins and primarily work in UTC-4, though it labels this an assessment rather than confirmed attribution. Yahoo Tech said Check Point Research did not disclose where the attackers come from. CSO Online reported that signs point to Russian origins but Check Point did not identify a group. Cybersecurity Intelligence reported that code analysis suggests the operators are probably Russian speakers.

The malware puts a WMProcess folder under ProgramData and copies WMPDMC.exe and wmpdui.dll there. A scheduled task pretending to be Microsoft launches three minutes after startup as Local System to run the loader.

YobaLoader pulls the Telegram channel t.me/yoba_fanclub profile picture to seed a domain generator at dedyn.io. It draws on the last 50 bytes of the Telegram profile picture for this task. The loader asks Google’s DNS-over-HTTPS service, which encrypts domain lookups, for a signed TXT record, checks the signature before decrypting, and obtains a payload link on Catbox. The Hacker News said the decrypted DNS TXT record directed to files.catbox.moe/z5zpy9.dat and that YobaLoader builds domains from dictionary words and a number from 0 to 999.

YobaLoader operates only under WMPDMC.exe and applies a separate hashing seed from the dropper. The loader can store payloads as executables after stripping the Zone.Identifier mark and can execute hidden PowerShell scripts that bypass execution policies.

The payload injected into svchost.exe is XMRig 6.26.0, aimed at an onion mining endpoint through a local Tor SOCKS5 proxy. Yahoo Tech reported that attackers abused interest in popular AI tools like GPT and Claude to distribute XMRig cryptominers and that XMRig is legitimate open-source software used to mine Monero, a privacy-first cryptocurrency more difficult to follow on the blockchain. Check Point Research said XMRig 6.26.0 consumes roughly 85% of CPU threads and resumes mining after 240 seconds without activity, and that it can load the WinRing0 driver service for MSR-based mining optimization. Yahoo Tech reported that cryptomining demands computing and electrical resources, leaving victims with higher energy and compute bills.

Check Point Research said previous Yoba versions surfaced in June 2026 and relied on Cursor.exe, a startup shortcut, a Russia-only exclusion, and .aber.ir. Help Net Security reported that an earlier Yoba variant from early June 2026 reused the same Telegram channel and profile image. The dropper and loader contain shared code, pointing to one developer. Earlier versions included anti-debugging and anti-VM checks, but recent builds removed those controls.

YobaDropper looks for a hard-coded hash value of 0xE6C2F326, while YobaLoader looks for 0x552751E3. These hash values confirm the name of the host executable at each stage.

The miner can slow a computer and raise electricity consumption. International Business Times said researchers verified no data theft and could not establish how many people worldwide the miner affected. Cybersecurity Intelligence reported that cryptocurrency mining serves as an initial phase and the underlying infrastructure can distribute ransomware or data-stealing tools.

Cybersecurity Intelligence reported that the campaign underscores dangers from staff using unauthorized Shadow AI tools that evade central IT policies. IT Voice reported that attackers exploit trust in and demand for AI tools instead of compromising AI models or services.

CSO Online said Yash Kadakia urged auditing permanent local administrator rights on developer workstations, which may store source code, API keys, cloud credentials, and pathways to internal infrastructure. Kadakia, founder and CTO at Security Brigade, pressed security teams to enforce application controls on DLL loading and execution behavior rather than executable signatures alone.

Help Net Security reported that Eli Smadja stated that research offers no indication anyone compromised the ChatGPT, Claude, OpenAI, and Anthropic services. Cybersecurity Intelligence reported that Smadja said cybercriminals can attack trust in AI without compromising the AI itself. “The AI boom is creating a new opportunity for cybercriminals: they can attack the trust surrounding AI without ever attacking the AI itself,” Smadja said.

Check Point advises organizations that discover Yoba to regard the infection as a wider compromise since YobaLoader can deliver any PE executable or PowerShell payload. Help Net Security reported this guidance. IT Voice reported that Check Point recommends confirming AI software at its origin and limiting unauthorized applications and administrator rights. International Business Times said people who executed fake installers should consider the machine potentially compromised and change passwords using a separate clean device.

Check Point Research told defenders to watch for questionable WMPDMC.exe copies under ProgramData and fake Microsoft scheduled tasks. Defenders should also observe Telegram-related traffic, DNS queries for dedyn.io via dns.google, and abnormal CPU usage. CSO Online said unexpected DLL loading by signed applications and execution from ProgramData can serve as compromise indicators.

Yash Kadakia said valid digital signatures do not guarantee that everything loaded by an executable or its distribution package is trustworthy. CSO Online published this on Oct. 28, 2026. OpenAI and Anthropic did not immediately reply to requests for comment.

Malwarebytes disclosed fake installers for ChatGPT and Claude on GitHub and SourceForge in May 2026. International Business Times said that earlier wave included videos drawing more than 50,000 views. That past campaign is separate from Yoba.