A malware campaign tracked as Yoba exploits the growing popularity of artificial intelligence applications by distributing malicious installers through fraudulent GitHub repositories and GitHub Pages websites impersonating legitimate ChatGPT and Claude desktop applications. The campaign uses deceptive software downloads and trusted application branding to trick users into installing malware. By bundling malicious components with legitimate, digitally signed executables, the operators attempt to bypass security controls and evade detection.
The infection begins when users download and execute ZIP archives containing legitimate OpenAI or Anthropic setup executables alongside a malicious DLL named winmm.dll. The DLL, identified as YobaDropper, exploits DLL sideloading to execute malicious code within the trusted application's process. It performs multiple anti-analysis checks, including process-name verification, prolonged execution delays, keyboard-layout detection, and administrator privilege checks to evade automated analysis. Following successful execution, YobaDropper creates a directory under ProgramData, deploys an additional malicious DLL, and establishes persistence through a scheduled task running under the Local System account. The scheduled task launches a legitimate Windows Media Player executable that sideloads the second-stage component, YobaLoader. The loader retrieves additional instructions through a Telegram channel, generates dynamic domains using a domain generation algorithm (DGA), and queries Google's DNS-over-HTTPS service to obtain encrypted payload locations. It subsequently downloads payloads from public hosting services such as Catbox and supports multiple execution methods, including process injection into svchost.exe, standalone executable execution, and hidden PowerShell execution. The observed final payload is XMRig cryptocurrency mining malware, which uses a Tor proxy to communicate with mining infrastructure and can monitor system activity to reduce noticeable resource consumption.[/subscribe_to_unlock_form]
A malware campaign tracked as Yoba exploits the growing popularity of artificial intelligence applications by distributing malicious installers through fraudulent GitHub repositories and GitHub Pages websites impersonating legitimate ChatGPT and Claude desktop applications. The campaign uses deceptive software downloads and trusted application branding to trick users into installing malware. By bundling malicious components with legitimate, digitally signed executables, the operators attempt to bypass security controls and evade detection.
The infection begins when users download and execute ZIP archives containing legitimate OpenAI or Anthropic setup executables alongside a malicious DLL named winmm.dll. The DLL, identified as YobaDropper, exploits DLL sideloading to execute malicious code within the trusted application's process. It performs multiple anti-analysis checks, including process-name verification, prolonged execution delays, keyboard-layout detection, and administrator privilege checks to evade automated analysis. Following successful execution, YobaDropper creates a directory under ProgramData, deploys an additional malicious DLL, and establishes persistence through a scheduled task running under the Local System account. The scheduled task launches a legitimate Windows Media Player executable that sideloads the second-stage component, YobaLoader. The loader retrieves additional instructions through a Telegram channel, generates dynamic domains using a domain generation algorithm (DGA), and queries Google's DNS-over-HTTPS service to obtain encrypted payload locations. It subsequently downloads payloads from public hosting services such as Catbox and supports multiple execution methods, including process injection into svchost.exe, standalone executable execution, and hidden PowerShell execution. The observed final payload is XMRig cryptocurrency mining malware, which uses a Tor proxy to communicate with mining infrastructure and can monitor system activity to reduce noticeable resource consumption.[emaillocker id="1283"]
It demonstrates how malicious actors abuse legitimate software, digitally signed executables, and trusted online platforms to distribute malware while evading traditional security detection mechanisms. Although the observed activity primarily involves cryptocurrency mining, YobaLoader's ability to execute additional executable and PowerShell payloads creates opportunities for deploying other malicious tools in future operations. Organizations should restrict unauthorized software installations, verify application download sources, monitor suspicious DLL sideloading activities, investigate unexpected scheduled-task creation, and detect unusual process relationships. Security teams should also inspect complete software packages rather than relying solely on valid digital signatures to establish application trustworthiness.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Persistence | T1574.002 | Hijack Execution Flow | DLL Side-Loading |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys |
| Privilege Escalation | T1548.002 | Abuse Elevation Control Mechanism | Bypass User Account Control |
| Defense Evasion | T1055.005 | Process Injection | Dynamic Link Library Injection |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Command and Control | T1571.002 | Ingress Tool Transfer | Ingress Proxy |
| Command and Control | T1071.004 | Application Layer Protocol | DNS |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Impact | T1499.004 | Endpoint Denial of Service | System Resources Consumption |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Anti-Behavioral Analysis | B0009 | Virtual Machine Detection |
| Command and Control | B0031 | Domain Name Generation |
| Command and Control | B0030 | C2 Communication |
| Command and Control | E1105 | Ingress Tool Transfer |
| Defense Evasion | E1055 | Process Injection |
| Execution | E1059 | Command and Scripting Interpreter |
| Impact | B0018 | Resource Hijacking |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Cryptography Micro-objective | C0029 | Cryptographic Hash |
| Cryptography Micro-objective | C0031 | Decrypt Data |
| Memory Micro-objective | C0007 | Allocate Memory |
The following reports contain further technical details:
[/emaillocker]