Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
AI-summarised brief · reviewed before publication
Threat actors behind the Yoba campaign are masquerading malicious loaders and XMRig cryptocurrency miners as AI desktop applications for Anthropic Claude and OpenAI ChatGPT. They create fake GitHub repositories—such as “GPT‑5.6 Sol,” “GPT‑6 Astra,” and “Claude Opus”—and host ZIP files that contain two DLLs, YobaDropper and YobaLoader. The DLLs employ DLL sideloading, placing themselves beside legitimate signed executables like OpenAI’s Setup.exe and Anthropic’s wmpdmc.exe, then use checksum checks to ensure they run only in the intended host. Advanced anti‑analysis measures include a 12‑day sleep loop, language and keyboard‑layout filters that skip several post‑Soviet states, and DoH‑based C2 traffic. The loader injects the miner into svchost.exe and establishes persistence via a scheduled task. The first repository appeared in July 2026, with malicious releases posted in August.
💡 Why It Matters
- · By exploiting trusted AI branding and GitHub’s reputation, the campaign evades casual scrutiny and blends crypto‑mining traffic with legitimate user activity, making detection far more difficult.
