Yoba Malware Hijacks Legitimate OpenAI and Anthropic Binaries to Deploy Crypto Miner via DLL Sideloading

Yoba Malware Hijacks Legitimate OpenAI and Anthropic Binaries to Deploy a Crypto Miner via DLL Sideloading

What Happened — Check Point Research tracked a new campaign, dubbed Yoba, that distributes a custom malware chain through fake GitHub projects masquerading as AI desktop applications (e.g., “GPT‑5.6 Sol”, “Claude Opus”). Each project hosts a ZIP file containing a legitimately signed OpenAI or Anthropic installer (Setup.exe) alongside a malicious winmm.dll. The signed executable loads the DLL—a classic DLL sideloading technique—allowing the dropper to fetch additional payloads and ultimately run a cryptocurrency miner on the victim’s system. The repositories rank highly in Google results thanks to SEO‑poisoning, and the releases were first observed in late August 2026.

Why It Matters for Trust & Control Assurance — The incident highlights a gap in software‑integrity controls: trusted signatures alone do not guarantee that bundled components are safe.

Who Is Affected — Any organization that downloads and runs third‑party desktop applications, especially those promoting AI tools, across all sectors.

Recommended Actions

• Enforce application allow‑listing and verify that all loaded DLLs originate from trusted sources.
• Deploy endpoint detection that monitors unexpected DLL loading and unsigned code execution.
• Integrate software‑supply‑chain scanning (hash verification, SBOM checks) into CI/CD pipelines.
• Maintain audit‑ready evidence of code‑signing validation and DLL provenance.

Technical Notes

• Attack vector: DLL sideloading via signed installers; SEO‑poisoned GitHub pages used for distribution.
• Malware components: YobaDropper → YobaLoader → crypto‑miner payload.
• Artifacts: Legitimate Setup.exe (OpenAI/Anthropic) + malicious winmm.dll in the same ZIP.
• Detection: Low detection rates; anti‑sandbox and obfuscation techniques employed.