Hackers Use Signed ChatGPT and Claude Binaries to Deploy Yoba Malware

Hackers are exploiting growing interest in AI tools to spread Yoba malware through fraudulent GitHub projects that claim to offer non-existent desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.

According to Check Point Research, these repositories and GitHub Pages attracted users through apparent SEO poisoning, with download buttons that delivered malicious ZIP files.

OpenAI, Anthropic, ChatGPT, and Claude were not compromised; attackers repackaged legitimate, digitally signed vendor executables alongside a malicious DLL.

ChatGPT and Claude Deploy Yoba Malware

When a victim runs Setup.exe, Windows loads the included winmm.dll through DLL sideloading. This DLL, known as YobaDropper, spoofs 180 exports that consist solely of RET and NOP instructions.

At the same time, its entry point contains the malicious logic. It checks that the host’s basename produces a DJB2 hash of 0xE6C2F326, corresponding to Setup.exe. If the verification fails, it executes 200,000 Sleep(5500) calls, approximately 12.73 days, while appending filler text to complicate sandbox analysis.

YobaDropper examines keyboard language IDs using the bitmask 0xEC0400C8401, deliberately avoiding systems with languages such as Russian, Belarusian, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Tajik, Turkmen, Uzbek, and Tatar, while excluding Ukrainian.

It dynamically resolves APIs from kernel32.dll and ntdll.dll using a DJB2 seed of 0x1505 and requires administrator rights. The dropper creates a directory at %ProgramData%\WMProcess, copies the legitimate WMPDMC.exe from System32, XOR-decrypts its embedded loader using the seed IRANNUMBERONE, and saves it as wmpdui.dll.

Persistence is achieved through a scheduled task disguised with the author labeled as “Microsoft Corporation” and a description stating, “Collects device metadata for Windows Media Player.”

This task runs as Local System (S-1-5-18) three minutes after boot, launching WMPDMC.exe, which sideloads YobaLoader. The loader accepts only the expected host hash of 0x552751E3; it retains the DJB2 seed of 0x1505 for process verification but changes the API hash to 0x1DEB, separating the hash spaces and making automated analysis harder.

For command execution, YobaLoader requests t[.]me/yoba_fanclub, extracts the Telegram profile image, and hashes the last 50 bytes to create an adjective, noun, verb, and number for a domain such as calm-piano-floats-313.dedyn[.]io.

It then queries the domain’s TXT record through Google DNS-over-HTTPS, Base64-decodes the response, verifies an Ed25519 signature using the public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64, and subsequently decrypts the commands using an AES-ECB key of 1d0d1368b4d53f3a6322cf40e84e63db.

A command prefix selects one of three execution paths: it can inject a PE into svchost.exe using NtWriteVirtualMemory and NtCreateThreadEx; save and execute a randomly named EXE after deleting its Zone.Identifier; or launch a hidden PowerShell script with -ExecutionPolicy Bypass.

The observed Catbox payload was XMRig 6.26.0, routed through Tor 0.4.9.12 and lyrebird 0.8.1 to a TLS-enabled onion pool. It pauses mining until 240 seconds of user inactivity, uses the mutex Local\WindowsSecurity, can load WinRing0 for MSR optimization, and suggests an 85% CPU-thread hint.

In earlier variants from June 2026, the malware targeted Cursor.exe, maintained persistence through a Startup shortcut, utilized .aber[.]ir DGA domains, and incorporated checks for DebugObject, CPUID, timing, CPU brand, and SMBIOS.

Although XMRig was observed, YobaLoader can deliver arbitrary PE or PowerShell payloads. Defenders should restrict the use of unapproved AI software, alert on signed processes that load DLLs from writable directories, inspect suspicious scheduled tasks, and monitor Telegram, Catbox, Tor, dynamic DNS, and unusual DNS-over-HTTPS TXT queries.

IoC

Type	Indicator
GitHub repositories/pages	github[.]com/gpt-5-6/sol-free-desktop; gpt-5-6.github[.]io; github[.]com/gpt-5-6/gpt-5-6.github.io; github[.]com/gpt-6-astra/gpt-6-astra.github.io; gpt-6-astra[.]github[.]io; opus-5-0[.]github[.]io; github[.]com/opus-5-0/opus-5-0.github[.]io
ZIP SHA-1	332e3b685e375aa44a5ec98511fc53be821df46a; c2b986704406d47dd88ee4e2fcffebc854ff2ce4
Signed binary SHA-1	163c81187d8024123912c3c12d905fd5210afcb3; 65a3ac8f341ae04982005fd2c4e83627a68793a3
YobaDropper SHA-1	17e8639a00bb32b10cb9cf0d292e9441456ce4bb; 20238b36645fc63139a76b19a480c6a9166472fa; 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586; 60aece343959a2e1840f6aaeffa38b73ed21af2c; 8777db31d8df78f36e4544a132d843dfb2a0f026
YobaLoader SHA-1	22661f4bada8167fa0f410b75e53184998990abb; 2ecb5548e9774a3d05e8669e8414dcc366929b79; 3fef1af3664429e621d3e0f9408cb5102ef02b84; 55043ea6d102670c014e2be5a8197e70b7c201cb; 79e87a6df59d68b2dbd2c43950df5663d671007c; 7dfcee02732ed89f1ddf25d1689863c26de3df15; bead5748d813a9828ddb7603a32e52aa15349768; cf90c4599257e76984a199d98b1fd082b820a54d; eeedc5c9007d7f01808285e0ae0c0b451bdba003
Telegram	t[.]me/yoba_fanclub; image SHA-1 e7c0e981f81447892995d01ed986c0b462a6f0c5
DoH/DGA	dns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXT
Payload URL	files.catbox[.]moe/z5zpy9.dat
Encrypted payload SHA-1	7467b6980440ec27c4e0a8d940672c9f24e14216
XMRig SHA-1	ea16728f6928dc77deaddee74a6e736dd5f24fc5
Mining/Tor endpoints	3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443; 51.89.228[.]250:21668; 51.89.231[.]85:24526

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.