Ethical Hacking News
The Yoba malware campaign has been uncovered, showcasing the sophistication of modern malware that leverages AI tools and trusted platforms to distribute cryptocurrency miners. This campaign highlights the need for organizations to be cautious when installing "AI helpers" or similar tools from unverified repositories and to enforce policies that restrict running software from unknown sources. By understanding the tactics, techniques, and procedures (TTPs) employed by attackers, defenders can develop effective countermeasures to mitigate the risks associated with this malware campaign.
The Yoba malware campaign uses fake GitHub projects to evade detection. The malware sideloads a malicious component, known as YobaDropper, within signed installers. The malware exploits a scheduled task to persist on the infected system. The malware uses a Telegram channel to fetch its payload and bypasses passive DNS monitoring. The malware injects a payload into svchost.exe, utilizing various techniques to avoid detection. The attackers may have Russian origins, but attribution is not confirmed. Defenders should look for suspicious activity, including fake Microsoft scheduled tasks, Telegram-related traffic, and unexplained high CPU usage. Organizations should be cautious about installing "AI helpers" or similar tools from unverified repositories.
The cybersecurity landscape has witnessed the emergence of a sophisticated malware campaign, dubbed Yoba, which has been successfully evading detection by leveraging the popularity of AI tools. The attackers have created fake GitHub projects that mimic real AI desktop applications, such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects not only appear convincing but also utilize real GitHub infrastructure, which lends them legitimacy to potential victims.
The Yoba malware chain is designed to sideload a malicious component, known as YobaDropper, which is embedded within signed installers. The dropper is then responsible for contacting an attacker-controlled infrastructure and fetching the final payload. The attackers have cleverly employed a technique called DLL sideloading, which bypasses security protections by loading the malicious DLL on its own.
The malware further exploits a scheduled task, disguised as a legitimate Microsoft task, to persist on the infected system. The task launches a legitimate program, which sideloads the malicious DLL. The YobaLoader, the second stage of the malware, shares code with the dropper and utilizes a different seed for hashing, which weakens hash-based detection.
The YobaLoader is designed to find its payload without a classic command server. It accomplishes this by querying a Telegram channel, t[.]me/yoba_fanclub, which contains a domain generator that builds names from word lists. The loader also uses Google's DNS-over-HTTPS service to fetch the payload, which helps bypass passive DNS monitoring and some gateway protections.
The YobaLoader can inject the payload into svchost.exe, save it as an executable after removing the Zone.Identifier mark, or run it as a hidden PowerShell script while bypassing execution policies. The injected payload is an XMRig 6.26.0 miner, which can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization.
The malware is designed to avoid detection by excluding Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Tatar keyboard layouts. However, it does not exclude Ukraine, which has often appeared in similar exclusion lists.
The attackers may have Russian origins and mainly operate in the UTC-4 time zone, but this is an assessment, not a confirmed attribution. Defenders are advised to look for suspicious WMPDMC.exe copies under ProgramData, fake Microsoft scheduled tasks, Telegram-related traffic, DNS lookups for dedyn[.]io through dns.google, and unexplained high CPU usage.
The Yoba campaign highlights the sophistication of modern malware and the use of trusted platforms and AI tools to distribute malware in a way that appears harmless at first glance. Organizations should be cautious about installing "AI helpers" or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources. Combining user awareness with basic technical controls is essential to mitigate the risks associated with this malware campaign.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Yoba-Malware-A-Sophisticated-Crypto-Miner-Disguised-as-Legitimate-AI-Tools-ehn.shtml
https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html
Published: Fri Oct 30 17:17:12 2026 by llama3.2 3B Q4_K_M
