Check Point Uncovers 'Yoba' Malware Campaign Using Signed ChatGPT and Claude Binaries to Target AI Users

Cybersecurity firm Check Point Research has exposed a malware campaign called Yoba that distributes fake ChatGPT and Claude desktop installers through SEO-poisoned GitHub repositories — and the attack is sophisticated enough to evade most antivirus tools because it abuses legitimate, digitally signed executables from OpenAI and Anthropic.

The campaign matters because it targets exactly the kind of user who is most likely to skip verification steps: someone excited about a new AI model, searching for a desktop app, and trusting that a GitHub result with a plausible name is real.

How the Attack Works

According to Check Point Research, Yoba uses a technique called DLL sideloading — placing a malicious dynamic-link library (DLL, a file that contains executable code loaded by other programs) in the same folder as a legitimate, signed application. When the real application launches, Windows loads the malicious DLL automatically without any warning.

The clever part: the legitimate executables are genuine OpenAI and Anthropic binaries with valid digital signatures. Antivirus software that checks signatures sees a trusted file. The malicious payload arrives invisibly alongside it.

The fake installers are distributed through GitHub repositories that have been SEO-poisoned — optimized to rank highly on Google searches — and use product names designed to attract early adopters:

• GPT-5.6 Sol
• GPT-6 Astra
• Claude Opus

Each name matches product lines that have been publicly announced or leaked, making the lures plausible to a non-expert.

What the Malware Does

Once installed, Yoba deploys XMRig, a widely used open-source cryptocurrency mining tool. XMRig silently uses the victim's CPU and GPU to mine Monero (XMR), a privacy-focused cryptocurrency. The mining traffic routes through Tor-based infrastructure (Tor is an anonymizing network that obscures the destination of internet traffic), making the receiving wallet effectively untraceable.

The victim's computer runs slower, power consumption rises, and hardware degrades over time — but there are no obvious symptoms that most users would connect to a software installation.

Why This Campaign Is Harder to Catch

Most credential-stealing malware or ransomware triggers behavioral alerts because it does unusual things quickly — reads password files, encrypts the disk, contacts foreign IP addresses. Crypto miners do none of that. They look like a legitimate background process using expected system resources.

The Tor routing adds another layer: network monitoring tools that flag outbound connections to known malicious IPs will not flag Tor exit traffic the same way.

The signed-binary abuse is the most technically significant element. Many enterprise security policies explicitly trust files with valid vendor signatures. By never modifying the signed executable itself — only adding a DLL next to it — the attacker stays inside that trust boundary.

How to Protect Yourself

• Download AI tools only from official sources: openai.com, anthropic.com, or their official GitHub organizations (github.com/openai, github.com/anthropics). Never from a third-party repository, regardless of how it ranks in search results.
• Verify the publisher in Windows: Right-click any installer, go to Properties → Digital Signatures. The signing certificate should belong to the company, not a generic organization name.
• Watch for unexpected CPU load: Task Manager or Activity Monitor showing sustained high CPU usage from an unfamiliar process after a new install is a warning sign.
• Run endpoint detection and response (EDR) software rather than traditional antivirus — EDR tools look at behavior patterns, not just signatures.

What to Watch

Check Point has disclosed the campaign details publicly, which typically prompts GitHub to remove the affected repositories. But the technique — DLL sideloading against signed AI app binaries — is reusable and will likely appear again with different brand names. As AI desktop apps become more common, they become a more attractive surface for exactly this kind of attack.