Yoba hides malware inside fake ChatGPT and Claude installers

What this is about

Check Point Research described a malware campaign called Yoba on October 27, 2026. The attackers present GitHub projects as desktop applications for ChatGPT and Claude. Someone who runs the offered installer may get a multistage infection chain on a Windows computer instead of a helpful AI tool.

The particularly deceptive part is that the packages really do contain legitimate, digitally signed programs from OpenAI or Anthropic. Malicious components are placed beside them and loaded when they run. The report therefore does not establish a breach of those providers’ official download servers. It shows how a genuine trust signal can be incorporated into a counterfeit package.

What the Yoba campaign actually does

The technical report describes fake repositories and GitHub Pages sites whose download buttons point to malicious ZIP archives in GitHub releases. Researchers found no evidence of artificially inflated stars or forks. Instead, the projects were conspicuous in Google results; the researchers consider search-engine poisoning the likely explanation.

The downloaded package contains a genuine signed executable alongside a modified software library. In a technique called DLL sideloading, the legitimate program loads a neighboring library. Foreign code then executes in association with a program that appears trustworthy. The executable’s signature does not automatically make the additional file trustworthy.

The first stage, YobaDropper, performs checks against analysis environments and requires administrator privileges, according to the report. It then sets up another component that can restart through a scheduled Windows task. This second stage, YobaLoader, retrieves instructions and further payloads. The campaign uses services including Telegram and encrypted DNS queries for control, and a hosting service for additional files.

Check Point observed the XMRig cryptocurrency miner as the final payload. It makes other people’s computers perform cryptocurrency-mining work. The researchers emphasize, however, that the loader can retrieve other programs or scripts. Observed mining and possible later malware must therefore be clearly distinguished.

Why it matters

The case concerns an everyday behavior: people search for a desktop version or supposed upgrade of a popular AI tool. A polished project page, a familiar platform name, and a valid signature can collectively suggest safety. None of these features alone answers the key question of whether the entire installation package comes from a verified source.

Cyber Security News and Cyber Press also report on the campaign and its combination of genuine program files with foreign libraries. Both accounts rely on Check Point. They are additional editorial sources, not independent technical replications of the malware analysis. A reliable count of affected people cannot be established from the reports reviewed here.

For individuals, the main implication is to begin the download journey at the actual provider, not at a search result with a convincing model name. For organizations, it also matters who is allowed to run unknown software with administrator privileges. These measures address the documented entry point; they are not a promise to prevent every other infection method.

In plain language

Imagine a parcel containing an original, sealed kitchen appliance. Beside it sits a modified accessory that connects automatically when the appliance is switched on. The genuine seal on the appliance says nothing about whether that extra component is safe.

In Yoba’s case, the signed program corresponds to the original appliance. The foreign library is the accessory. Checking only the seal means checking a genuine component while potentially overlooking the dangerous rest of the package. That is why the origin of the entire download matters more than a single reassuring feature.

A practical example

An explicitly fictional office with twelve employees receives a link to a supposedly new AI desktop application. One person downloads the ZIP package onto a Windows laptop. Before installation, the responsible colleague checks whether the official provider actually links to that repository. Without a traceable download route, the package is not executed.

The twelve employees are an illustrative number, not the campaign’s victim count. If the program has already run, simply deleting the ZIP archive would not be an adequate investigation: the report describes downstream components and an automatic restart mechanism. The IT team would need to examine the device and its activity rather than infer safety from an unremarkable interface.

Scope and limits

• No established provider compromise: The report describes counterfeit distribution routes abusing genuine files. It does not establish that official ChatGPT or Claude downloads are infected.
• Unknown scale and uncertain attribution: The reviewed sources provide no reliable total victim count. Clues about the operators’ origins do not amount to verified identification.
• Observation is not every possible outcome: XMRig was observed as a payload. Other malware is technically possible, but that does not establish its actual deployment in these investigated cases.

Hero image: symbolic workplace photograph from Unsplash; it does not show a device known to be affected.

SEO & GEO keywords

Yoba, YobaDropper, YobaLoader, ChatGPT, Claude, fake AI installers, DLL sideloading, GitHub, Windows security, XMRig