A campaign that Check Point Research calls Yoba has been luring people who go looking for the newest AI tools onto GitHub repositories that look like desktop apps for ChatGPT and Claude. The downloads are not apps. They are ZIP archives that quietly install a loader, and the loader’s final job is to run an XMRig cryptocurrency miner on the victim’s PC.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Check Point published its analysis on October 27, 2026, and The Hacker News covered it two days later. The first repository appeared around July 2026, malicious releases followed on August 30, August 31 and September 4, and the researchers had been tracking the operator for about two months by the time they went public.
Three repositories dressed as GPT-5.6 Sol, GPT-6 Astra and Claude Opus
According to Check Point Research, the lures are fake GitHub projects named for products that people are eager to try: “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.” Each has a matching github.io page that describes the software and adds a veneer of credibility, and each repository was uploaded under a different Outlook email address. The uploader’s commit timestamps point to different time zones, UTC+4, UTC-4 and UTC+3, which the researchers read as deliberate obfuscation.
The Hacker News, summarizing the findings, noted that search engine poisoning may be pushing the pages up in Google results, though the researchers found no evidence of inflated star counts or other fake popularity signals. A user who types a model name plus “download” has no obvious way to tell a genuine vendor page from a project that merely borrowed the name.
The operator was not new to the technique. Check Point traced an earlier YobaDropper variant to early June 2026 and the first commit in the main repository to July 16. The lure archives are small, ten files each, and only winmm.dll was compiled on the day it was added. Check Point also found three known process-name hashes in the code, tied to the ChatGPT and Claude Opus lures, to Cursor AI and to one unidentified product, so the same trick has been prepared for more than one popular tool.
A signed executable that carries the malware in with it
Each lure ZIP contains a legitimate, signed OpenAI Codex or Claude executable renamed Setup.exe, next to a malicious file called winmm.dll. When the signed program starts, Windows loads the DLL from the same folder, the pattern catalogued by MITRE as DLL search order hijacking and known informally as DLL sideloading. Because the process doing the loading is a properly signed binary from a well-known company, many security tools treat the activity with less suspicion than they would an unsigned program.
The fake winmm.dll, which Check Point calls YobaDropper, exports 180 functions that are all stripped of code except the entry point. It checks that it is running inside a file named Setup.exe by hashing the file name against a hard-coded value, and it stalls by calling Sleep 200,000 times at 5,500 milliseconds each, about 12.73 days, a delay meant to outlast an automated sandbox. It also exits on machines using Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek or Tatar keyboard layouts, and Check Point says the actor shows indicators suggesting Russian origins.
If the checks pass, the dropper copies a legitimate Windows binary, wmpdmc.exe, from System32 into a new folder under ProgramData, drops a second malicious DLL beside it, and sets up a scheduled task so that the pair relaunches. That repeats the sideloading trick, this time with a Microsoft-signed host, and it gives the malware persistence across reboots.
A loader that finds its server through Telegram, DNS and a file host
The next stage, YobaLoader, avoids a fixed command server. It downloads an image from a Telegram channel and uses the last 50 bytes of that file as the seed for a domain generation algorithm, built from 21 adjectives, 21 nouns, 18 verbs and a number from 0 to 999. It then queries Google’s DNS-over-HTTPS service for an encoded TXT record on the generated domain, decrypts that record to get a download address, and pulls its next stage from the catbox.moe file host. Check Point says the operator leans on Telegram, Tor, Catbox and DNS over HTTPS so that passive DNS monitoring and gateway filters see only ordinary traffic.
The payload observed was XMRig version 6.26.0, a Monero miner, injected into svchost.exe so that it hides inside a normal Windows process. Check Point stresses that YobaLoader is generic and could deliver something worse than a miner. Early versions excluded only Russia and carried heavy anti-debugging and anti-virtual-machine checks, which the operator later removed, and the Hacker News write-up noted that Ukraine is no longer on the keyboard-layout exclusion list.
Neither report says whether GitHub has removed the three repositories, and Check Point lists the repository names and indicators of compromise in its report for defenders to block. What the research cannot answer is how many people have already run Setup.exe, because the operator never needed to build its own infrastructure to count them.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
