Cybersecurity researchers at **Check Point Research** have uncovered the **Yoba** campaign, which sees threat actors creating fraudulent **GitHub** projects that mimic legitimate AI desktop applications such as **GPT-5.6 Sol**, **GPT-6 Astra**, and **Claude Opus**. These deceptive projects, however, serve as conduits for delivering the **YobaLoader** malware.  ### The Deceptive Delivery Method The attackers strategically place their malware alongside legitimate, signed executables from **OpenAI** and **Anthropic**. This enables a technique known as **DLL sideloading**, where the malicious **winmm.dll** is loaded indirectly by a legitimate **Setup.exe**, effectively bypassing security protections. To enhance credibility, the threat actors establish **GitHub.io** pages detailing the fake software's capabilities. While **Check Point Research** indicates that the popularity of these **GitHub** projects isn't inflated by 'ghost networks,' there's strong evidence of **SEO poisoning**. This tactic ensures that links to these malicious repositories appear prominently in **Google** search results, increasing the likelihood of user engagement. Identified malicious **GitHub** page links include: * github[.]com/gpt-5-6/sol-free-desktop * gpt-5-6.github[.]io * github[.]com/gpt-5-6/gpt-5-6.github.io * github[.]com/gpt-6-astra/gpt-6-astra.github.io * gpt-6-astra[.]github[.]io * github[.]com/opus-5-0/opus-5-0.github[.]io * opus-5-0[.]github[.]io Researchers noted an inconsistency in the email addresses and operational time zones associated with these repositories, suggesting a deliberate attempt to obfuscate the threat actor's true location and identity. ### YobaDropper and Anti-Analysis Techniques The ZIP archives hosted in these repositories contain two key components: a legitimate signed **OpenAI Codex** or **Claude** executable (**Setup.exe**) and a malicious **winmm.dll**. This DLL acts as a dropper, codenamed **YobaDropper**. It incorporates anti-analysis measures, including checksum value checks that require it to be launched specifically by "Setup.exe," preventing execution in sandboxed environments. Further anti-analysis techniques include a prolonged sleep delay (200,000 iterations of 'Sleep(5500)', totaling approximately 12.73 days) and checks against keyboard layouts corresponding to several countries, including Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. Notably, Ukraine, which has historically been part of such exclusion lists, is absent.  ### The YobaLoader Payload **YobaDropper** initiates its own **DLL sideloading** chain, involving "wmpdmc.exe" and "ampdui.dll." It extracts and decrypts an embedded payload, dropping it into the "WMProcess" directory under "ProgramData" and establishing persistence via a scheduled task. The second DLL, **YobaLoader**, also employs anti-sandbox techniques, requiring execution by "wmpdmc.exe." **YobaLoader** performs several critical functions: * Downloads an image from a **Telegram** channel (t[.]me/yoba_fanclub). * Utilizes the last 50 bytes of the image as a seed to generate a domain using a **domain generation algorithm (DGA)**, resulting in a domain format like "*adjective*-*noun*-*verb*-*digit*.dedyn[.]io." * Queries **Google's DNS-over-HTTPS (DoH)** API to retrieve a **Base64**-encoded command from a **DNS TXT record**. * Decrypts the response to obtain a link for the next-stage payload, which is then injected into "svchost.exe," leading to the execution of an **XMRig cryptocurrency miner**. By leveraging **DoH** services and common file-hosting platforms, the attackers aim to evade passive DNS monitoring and gateway-based security protections, making their command-and-control traffic more difficult to detect. ### Evolution and Implications Evidence suggests the initial **GitHub** repository for this campaign appeared around July 2026, with malicious releases uploaded by the end of August. Early versions of **YobaLoader** primarily excluded Russia from infection and included extensive anti-debugging and anti-VM checks, which have since been removed in newer iterations. The **Yoba** campaign underscores the persistent threat of attackers exploiting current technological trends, such as AI, to distribute malware. By packaging malicious code with trusted software names and hosting it on platforms like **GitHub**, they significantly reduce the likelihood of immediate detection by users and basic security mechanisms. IT security professionals and privacy-conscious users are urged to exercise extreme caution when downloading and installing software, particularly from unofficial sources, even if they appear legitimate.