On October 28, 2026, Check Point Research reported that the Yoba campaign used fake GitHub projects to distribute Windows malware under ChatGPT- and Claude-themed names. Three malicious ZIP releases were uploaded on August 30, August 31 and September 4. In the analyzed chain, a malicious DLL loaded alongside a signed executable; the final payload Check Point analyzed was the XMRig 6.26.0 cryptocurrency miner.
How the fake downloads reached users
The projects used the names GPT-5.6 Sol, GPT-6 Astra and Claude Opus. These were names for fake projects, not official OpenAI or Anthropic products. GitHub repositories and linked GitHub Pages promoted the purported apps, while the malicious ZIP files were hosted as GitHub releases. The projects appeared high in Google results, which Check Point researchers assessed was likely due to search-engine optimization poisoning.
The reported activity involved fake projects and malicious downloads, not a reported compromise of OpenAI’s or Anthropic’s official services.
Why a valid signature did not clear the neighboring DLL
Check Point says the attackers placed a malicious winmm.dll beside a legitimate, signed Setup.exe associated with OpenAI or Anthropic. DLL sideloading is a technique in which a program loads a nearby DLL, or dynamic-link library, when it runs. A valid signature on the executable applies to that signed file; it does not certify a separate DLL placed next to it.
The newer dropper then copied WMPDMC.exe from the Windows System32 folder into ProgramData\WMProcess, placed wmpdui.dll alongside it and created a scheduled task to run the files at startup after a three-minute delay under the Local System account.
What the loader retrieved
Check Point describes YobaLoader using the last 50 bytes of a Telegram channel’s profile image to seed a domain-generation algorithm. It queried Google DNS-over-HTTPS TXT records for tasking and retrieved an encrypted payload from Catbox. The loader can deliver executable or PowerShell payloads, but the final payload identified in this analyzed campaign was XMRig 6.26.0.
A separate Claude case involved a genuine domain
On July 27, 2026, Zip Security reported a different Claude-themed installer campaign. It described fake installer pages placed in public user-created artifacts under the genuine claude.ai domain and promoted through paid search ads. That case was separate from Yoba. A familiar domain does not, by itself, establish that user-created content or a download hosted there is trustworthy.
Check Point recommends avoiding AI helpers from unverified repositories and restricting software execution from unknown sources.
