Fake ChatGPT & Claude Apps Spread Yoba Malware: Defense Guide

The core problem is that code signing proves who built one file, not that the folder around it is safe. Yoba exploits that gap with a technique known as DLL sideloading: a legitimate, signed program loads a library named winmm.dll from its own folder, and the attacker supplies a malicious copy.

Several things make this campaign hard to catch with basic controls:

• The visible file is genuine. A signed OpenAI Setup.exe or Claude executable passes reputation checks and signature checks, so many tools stay quiet.
• The lure sits in search results. The fake repositories used popular product names and ranked prominently, with no evidence of artificially inflated stars or forks, so there was little visible warning.
• The malware is patient. According to Check Point, the first stage checks that it was started by the expected Setup.exe and introduces a lengthy delay if not. It also applies regional language checks and needs administrator privileges to continue, behavior designed to frustrate sandboxes and analysts.
• The command channel is unconventional. The loader reads a Telegram channel's profile image to generate a domain, queries Google DNS-over-HTTPS for a TXT record, decrypts the answer and downloads an encrypted payload from external hosting such as Catbox.

Combined, these tricks mean a reputation-based blocklist has little to latch on to. Defenders need behavioral visibility, and a managed security operations team that watches for the pattern rather than a single file hash.

The Yoba chain turns a routine software search into a persistent foothold in five stages.

1. Search and download. An employee looks for a desktop AI app and lands on a fake GitHub project or GitHub Pages site, then downloads a ZIP from the releases section.
2. Launch of the signed file. The user runs the genuine, signed Setup.exe or Claude executable. Nothing looks wrong.
3. Sideloading. The program loads the malicious winmm.dll from the same folder. This first stage, called YobaDropper, verifies it was launched correctly and that it has administrator rights.
4. Persistence. YobaDropper installs a second stage, YobaLoader, next to a legitimate Windows executable and creates a scheduled task so the legitimate file sideloads the loader after every system startup.
5. Payload retrieval. YobaLoader finds its command domain through the Telegram profile image trick, validates a DNS TXT response and pulls an encrypted payload.

In the campaign Check Point analyzed, the final payload was the XMRig cryptominer, version 6.26.0. Reportedly, it can reach its infrastructure over Tor and pauses mining while the user is actively working, which keeps the machine from feeling slow. Check Point is clear that YobaLoader is a generic loader that can deliver other Windows executables or PowerShell payloads, so a miner today can be something far worse tomorrow. Any machine that ran one of these packages should be treated as a broader compromise, not just a wasted CPU.

Closing this path protects more than a few laptops. It protects credentials, performance and the credibility of your AI adoption program. A practical defense, based on the recommendations in the Check Point analysis, looks like this:

• Provide a sanctioned route to AI tools. Publish an approved list and download source, so employees never need to search for desktop clients. Vendor-controlled channels only, never search rankings, GitHub pages or third-party links.
• Restrict unauthorized applications and administrator rights. YobaDropper needs administrator privileges, so removing standing local admin and enforcing application control stops many infections early.
• Monitor what legitimate programs load. Alert when a signed application loads an unexpected winmm.dll from a user-writable folder, or when a new scheduled task launches a legitimate binary from an odd location.
• Detect beyond the first file. Behavioral protection and incident analysis catch the loader, the scheduled task and the outbound traffic even when the initial file is signed.
• Block unusual command channels. Filter generated domains and monitor DNS-over-HTTPS and Tor usage at the network edge, ideally through a secure multi-operator network with centralized policy.
• Train for search-result risk. Teach staff that a high Google ranking and a GitHub page are not proof of legitimacy.

The payoff is lower incident volume, fewer surprise performance complaints and a clear audit trail showing that AI tools are adopted under control. Cryptomining may sound minor, but the same access can carry credential theft or ransomware, so catching it early is cheap insurance.

HIT Communications helps enterprises adopt new technology, including AI, without giving attackers an easy way in. With more than 30 years of experience across Latin America, the United States and Europe, we combine the network, the endpoint and the monitoring in one accountable service.

Our cybersecurity team provides a 24/7 security operations center, SIEM and managed detection and response, built to spot behaviors like unexpected DLL loads, new scheduled tasks and unusual DNS activity. Our IT managed services cover endpoint hardening, application control, patching and user guidance, including how to roll out approved AI tools safely. And because we operate multi-operator connectivity underneath, we can apply filtering and visibility where your traffic actually flows.

If you are unsure whether an AI download has already slipped onto your fleet, we can help you hunt for the indicators and set controls that prevent a repeat.

The Yoba campaign proves that a valid signature is not a guarantee of safety, and that attackers now ride the AI adoption wave. Fake GPT and Claude desktop packages, SEO-poisoned GitHub pages and a loader that can deliver anything make this a risk worth acting on today.

Start with three moves: publish an approved source for AI tools, remove unnecessary administrator rights, and make sure someone is watching for sideloaded DLLs and suspicious scheduled tasks. If you want help assessing your exposure or putting a managed SOC behind these controls, contact the HIT Communications team and we will help you adopt AI without adding risk.