Ethical Hacking News
Threat actors are using fake GitHub projects to distribute malware that deploys cryptocurrency miners. The malware, dubbed Yoba, is designed to evade detection by using signed executables and anti-analysis techniques. The campaign highlights the sophistication of threat actors in utilizing trusted platforms and the current interest in AI tools to distribute malware. To stay safe, it is essential to keep up-to-date with the latest security patches and updates and to be vigilant when interacting with software from unfamiliar sources.
Threat actors are using signed executables from reputable companies like OpenAI and Anthropic to distribute malware. The malware campaign, dubbed Yoba, creates fake GitHub projects with legitimate-looking applications. The fake applications are delivered as ZIP archives with a malicious DLL that's sideloaded by the executable. The malware uses anti-analysis techniques and pre-checks to evade detection, including skipping certain languages and keyboard layouts. The primary goal of the malware is to deploy a cryptocurrency miner, specifically XMRig, by injecting it into the "svchost.exe" process. The Yoba campaign highlights the sophistication of threat actors in using trusted platforms and AI tools to distribute malware. The campaign emphasizes the importance of staying vigilant and keeping up-to-date with the latest security patches and updates.
Threat actors have been utilizing a sophisticated campaign to distribute malware by abusing signed executables from reputable companies such as OpenAI and Anthropic. The malicious campaign, dubbed Yoba, involves the creation of fake GitHub projects that claim to be desktop applications, such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The fake applications are designed to appear legitimate, with the attackers setting up GitHub.io pages to describe the capabilities of the software.
The fake applications are delivered as ZIP archives that contain a legitimate signed OpenAI Codex or Claude executable, winmm.dll, a malicious DLL that's sideloaded by the executable. The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value "0xE6C2F326." In other words, the check requires it to be launched under "Setup.exe," and fails if the DLL is executed on its own inside a sandboxed environment.
The attackers have also employed additional anti-analysis techniques and pre-checks to evade detection. These include 200,000 iterations of "Sleep(5500)," which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. Another language ID excluded from the infection process is Tatar. Notably missing from the list is Ukraine, which used to be historically included in such checks.
The YobaLoader, another key component of the malware, triggers a DLL sideloading chain of its own comprising "wmpdmc.exe" and "ampdui.dll." The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as "wmpdui.dll." It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.
The malware's primary goal is to deploy a cryptocurrency miner, specifically XMRig, by injecting it into "svchost.exe." The malware has been found to have evolved over time, with early versions only excluding Russia from infection and incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.
The Yoba campaign highlights the sophistication and creativity of threat actors in utilizing trusted platforms and the current interest in AI tools to distribute malware. By packaging their code together with well-known software names and hosting it on GitHub, the attackers lower the chances that users or basic security checks will immediately flag the files as suspicious.
In an analysis, Check Point Research stated that the Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance. The campaign also demonstrates the importance of staying vigilant and keeping up-to-date with the latest security patches and updates to prevent falling prey to such sophisticated threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Sophisticated-Campaign-Fake-ChatGPT-and-Claude-Apps-Abuse-Signed-Executables-to-Deploy-Crypto-Miners-ehn.shtml
https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
Published: Thu Oct 29 11:21:44 2026 by llama3.2 3B Q4_K_M
