The operation, identified as Yoba, uses fraudulent GitHub repositories and accompanying websites advertising supposed applications named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Researchers disclosed the campaign on 27 October after tracking its activity for approximately two months.
Attackers placed malicious files alongside authentic executables signed by OpenAI and Anthropic. When users launch the installers, the legitimate programs load the accompanying malicious components through a technique known as dynamic-link library, or DLL, sideloading.
Check Point stressed that its findings do not establish any compromise of OpenAI, Anthropic or their AI services. The attackers instead exploit the credibility of genuine software signatures and familiar product names to make independently distributed packages appear trustworthy.
The fraudulent projects were hosted on GitHub, with promotional pages created using GitHub Pages and downloadable ZIP archives distributed through repository releases. Some appeared prominently in Google search results, behaviour researchers associated with search engine optimisation poisoning, although they found no evidence of artificially inflated repository stars or forks.
The initial malicious component, named YobaDropper, masquerades as a Windows multimedia library called winmm. dll. It is positioned beside a signed Setup. exe file so that Windows loads the hostile library when the legitimate executable starts.
Before proceeding, the dropper checks the name of its host process, examines keyboard language settings and demands administrator privileges. Its process-name test is designed to obstruct automated malware analysis: an unexpected executable name triggers a prolonged delay rather than ordinary execution.
The language checks exclude several countries associated with the Commonwealth of Independent States, including Russia and Belarus, while explicitly treating Ukrainian differently. Researchers described these checks as technical indicators rather than proof of the perpetrators’ nationality.
After gaining elevated privileges, the malware creates a directory under Windows ProgramData, copies a legitimate Windows Media Player executable into it and installs another malicious library, which researchers call YobaLoader.
A scheduled task then launches the copied executable after startup, causing it to load the second malicious component. The task impersonates Microsoft Corporation in its descriptive fields and is configured to run under the powerful Local System account, with a three-minute startup delay.
YobaLoader subsequently retrieves instructions and payloads using an infrastructure deliberately spread across established online services. Check Point identified Telegram, the Catbox file-hosting service, Tor and Google’s DNS-over-HTTPS resolver among the mechanisms involved.
Researchers observed the loader delivering XMRig, software commonly used to mine cryptocurrency. However, its functionality also permits the retrieval and execution of other Windows programs or PowerShell commands, meaning the observed cryptocurrency-mining activity does not define its full technical capabilities.
The use of legitimate hosting and communication services complicates efforts to distinguish hostile traffic from ordinary internet activity. It also allows the operators to avoid maintaining a conventional dedicated command-and-control server throughout the infection chain.
The malware’s architecture permits instructions to be retrieved without relying on a single conventional server. Researchers identified mechanisms for obtaining encrypted payloads and executing them within other Windows processes, further complicating detection. Such capabilities could allow operators to change their activities without replacing the initial infection method. Check Point has not established how many computers were compromised, the geographical distribution of victims or the financial returns generated by the observed cryptocurrency mining. Its findings primarily document the malware’s technical behaviour and distribution infrastructure.
Check Point linked the campaign to an earlier Yoba variant observed in June, when a malicious component was configured to execute through a process named Cursor. exe, associated with an AI coding application. Researchers could not establish whether that earlier host executable carried a valid digital signature.
Differences between the variants include changes to persistence mechanisms, payload extraction and checks intended to frustrate security analysis. The underlying approach of loading hostile code through apparently legitimate software remained consistent.
Investigators identified clues suggesting a Russian connection, including language exclusions and other characteristics, but did not establish the operator’s identity. Compilation timestamps also suggested activity aligned with the UTC-4 time zone, a finding that does not independently identify the attackers’ location.
Check Point published technical indicators covering malicious repositories, file hashes and network destinations to help security teams identify affected systems. The disclosed samples included separate archives for the ChatGPT-themed and Claude-themed installers, each combining authentic executable files with unauthorised components.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
