Check Point Research Documents Yoba Malware Abusing Signed ChatGPT and Claude Binaries for DLL Sideloading
Date: 2026-10-28
Tags: malware, phishing
Executive Summary
Check Point Research uncovered Yoba, a campaign using fake GitHub projects that impersonate ChatGPT and Claude desktop apps and abuse legitimate signed OpenAI and Anthropic executables to sideload the YobaDropper. The projects ranked prominently in Google Search via SEO poisoning, and the final payload observed was XMRig 6.26.0, though YobaLoader can deliver other Windows or PowerShell payloads. Defenders must treat a valid signature as proof of one binary only, not of the surrounding package.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | Yoba |
| Attribution | Unattributed (confidence: none) |
| Target | Users seeking ChatGPT and Claude desktop applications, including developers |
| Vector | Fake GitHub projects impersonating AI desktop apps, distributed through SEO poisoned search results, with DLL sideloading via winmm.dll |
| Status | active |
| First Observed | 2026-10-27 |
Detailed Findings
Check Point Research published on 2026-10-27 that it found Yoba, a malware campaign distributing fake GitHub projects that impersonate purported ChatGPT and Claude desktop applications. According to Check Point Research, the packages combine malicious components with legitimate software: the ChatGPT themed package carried a legitimate signed OpenAI Setup.exe and the Claude themed package carried a legitimate signed Claude executable. Check Point Research reported that when launched, these executables sideload a malicious winmm.dll placed alongside them, a technique known as DLL sideloading, so the signed binary is genuine while the surrounding package is not. The malicious projects appeared prominently in Google Search, consistent with SEO poisoning, and the final payload observed was XMRig 6.26.0, which mines cryptocurrency, can route through Tor, and pauses mining while the victim is active. Check Point Research noted YobaLoader is a generic loader capable of delivering other Windows executable or PowerShell payloads, making the loader more significant than the observed miner. Check Point Research stated its research does not indicate that ChatGPT, Claude, OpenAI, or Anthropic were compromised.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| DLL Side-Loading | T1574.002 | Malicious winmm.dll sits beside legitimate signed OpenAI and Anthropic executables that load it on launch |
| Resource Hijacking | T1496 | Final XMRig 6.26.0 payload mines cryptocurrency and pauses while the victim is active |
IOCs
Domains
_Check Point Research did not publish specific fake GitHub repository URLs, hashes, or C2 endpoints in the summary. Bare shared hosts Telegram, Google DNS over HTTPS, and Catbox were cited as communication and delivery services and are not emitted as domain IOCs._
Full URL Paths
_Check Point Research did not publish specific fake GitHub repository URLs, hashes, or C2 endpoints in the summary. Bare shared hosts Telegram, Google DNS over HTTPS, and Catbox were cited as communication and delivery services and are not emitted as domain IOCs._
Splunk Format
_No IOCs available for Splunk query_
Affected Platforms
WindowsDetection Recommendations
Alert on winmm.dll loaded from user download or install directories adjacent to signed OpenAI and Anthropic executables, and on unsigned or newly written DLLs alongside signed installers. Hunt for XMRig 6.26.0 process and network behavior including Tor egress, and monitor for outbound connections to Catbox and Telegram services from developer endpoints. Educate users that search results for AI desktop apps are a social engineering vector and enforce application allowlisting so signed binaries cannot cargo cult unsigned sibling DLLs.
References
- [Check Point Research] Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users (2026-10-27) — https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/