- Threat actors are distributing cryptocurrency miners through fake GitHub projects mimicking AI desktop apps for Anthropic Claude and OpenAI ChatGPT.
- The campaign, dubbed Yoba, uses DLL sideloading to bypass security by placing malicious loaders next to legitimate signed executables.
- Infected systems deploy XMRig miner via a multi-stage process involving a Telegram channel and Google DNS-over-HTTPS for command-and-control.
- Attackers employ anti-analysis techniques, including a 12.73-day sleep delay and exclusion of keyboards from Russia and several neighboring countries.
- SEO poisoning tactics help the fake GitHub pages rank high in Google search results, increasing the reach of the malware.
Threat actors are delivering cryptocurrency miners under the guise of AI desktop applications for Anthropic Claude and OpenAI ChatGPT in a campaign called Yoba. The operation creates fake GitHub projects, such as GPT-5.6 Sol and Claude Opus, that host malicious loaders named YobaLoader and YobaDropper.
According to an analysis by Check Point Research, the malware uses DLL sideloading by placing a malicious winmm.dll next to legitimate signed executables from OpenAI or Anthropic. Consequently, when users run the fake installer, the executable loads the rogue DLL, which then performs extensive anti-analysis checks.
The dropper waits for 200,000 iterations of 5.5-second sleeps—totaling 12.73 days—and skips machines with keyboard layouts matching Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. Additionally, the Tatar language ID is excluded, while Ukraine is notably absent from the block list.
After bypassing these checks, YobaDropper initiates a second DLL sideloading chain using a system file copied from the Windows folder. It then extracts and decrypts an embedded payload, establishing persistence via a scheduled task that reloads the malicious DLL.
The second-stage loader, YobaLoader, retrieves an image from a Telegram channel and uses the last 50 bytes as a seed to generate a domain via a domain generation algorithm. It queries Google’s DNS-over-HTTPS API to obtain an encrypted command from a DNS TXT record, ultimately fetching the next-stage payload from a file-hosting platform.
The final payload is injected into svchost.exe, executing an XMRig cryptocurrency miner. The first GitHub repositories appeared around July 2026, with malicious uploads starting in late August; earlier YobaLoader versions only excluded Russia and included extra anti-debugging checks later removed.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
