Threat actors · Briefing
Yoba uses fake ChatGPT and Claude downloads to deliver malware through signed executables
Reports describe GitHub downloads that pair legitimate software with malicious DLLs. Defenders should investigate the loader’s foothold as well as the cryptocurrency miner it delivered.
Kinwilder research desk · · AI-assisted analysis
Briefing — 31 October 2026
What is established
Fake ChatGPT and Claude desktop downloads on GitHub delivered the Yoba malware chain and an XMRig cryptocurrency miner, according to Check Point research covered by The Hacker News, published on 29 October 2026. Legitimate, signed OpenAI or Anthropic executables loaded a malicious neighbouring DLL. Defender assessment: finding the miner should trigger investigation of how additional code became authorised to run.
Help Net Security, also published on 29 October, says the research does not indicate that ChatGPT, Claude, OpenAI or Anthropic were compromised.
Security Affairs, published on 30 October 2026, dates malicious releases to 30–31 August and 4 September 2026, with earlier variants appearing in June. It describes persistence through a scheduled task and a copied WMPDMC.exe under ProgramData. The packet establishes no containment outcome or patch remedy.
Who is behind it
Check Point calls the campaign Yoba. YobaDropper and YobaLoader are malware components; XMRig is the mining payload, as The Hacker News reports.
Help Net Security relays an assessment of signs of Russian origin and activity mostly in UTC-4. Identity, physical operator location and state sponsorship remain unestablished. No ransomware brand or affiliate is identified. Analysis: mining supports a financial motive for the observed payload, but does not establish the operator’s wider objectives. Keyboard-language exclusions cannot establish victim geography.
Our analysis
Analysis: the central trust boundary is between an approved executable and the additional code it loads. The authorisation invariant should be simple: permission to execute a signed application must not automatically authorise arbitrary neighbouring libraries. A valid signature provides evidence about the signed file; it cannot vouch for every file bundled alongside it.
The delivery mechanism also uses Telegram, Google DNS over HTTPS and Catbox, according to Help Net Security.
Analysis: this creates a second assessment problem. A familiar hosting service or encrypted connection offers little assurance about the process using it. Process identity, executable location and loaded modules become important context for network events.
Analysis: organisations permitting unmanaged software downloads and broad local administrator access have plausible exposure to this delivery pattern. That is a conditional risk assessment, not evidence of additional victims. Watch for changes in delivered payloads and installation paths; a detection strategy tied only to mining activity could miss a different use of the foothold.
Defensive actions
Kinwilder recommendations, prioritised:
- Contain and scope confirmed infections. Isolate affected endpoints while preserving process, task and file evidence. Check Point recommends treating Yoba as a broader compromise and investigating beyond XMRig, according to Help Net Security. Establish which account launched the download, whether elevation occurred and what subsequently executed. Base credential resets on evidence of exposure.
- Hunt across endpoint records. Security Affairs highlights suspicious WMPDMC.exe copies beneath ProgramData and scheduled tasks impersonating Microsoft. Correlate these with module-load telemetry, task-registration records, process ancestry and file creation times. Investigate combinations of signals; a filename or vendor-like task description alone is insufficient.
- Tighten installation and execution controls. Provide an approved route for obtaining AI applications. Assess whether application control covers loaded libraries as well as executables, and whether users can elevate unverified installers. Retain enough endpoint and network history to connect an installation with later execution. Evaluate these controls in your environment before relying on them.
Key concepts
- DLL sideloading: a legitimate executable loads an attacker-supplied software library placed where the program searches.
- Persistence: a mechanism that causes code to run again after its initial execution, such as a scheduled task.
- DNS over HTTPS: DNS queries transported inside HTTPS, which can reduce visibility for monitoring based on conventional DNS traffic.
Limits
Evidence assessment: all three publishers recount Check Point’s research; they do not constitute three independent investigations. The packet supplies no primary research report, infection count, named victim, affected-version range, CVE, confirmed victim country or sector. Current download availability and subsequent payload changes are unconfirmed. Kinwilder did not reproduce the malware chain or test these recommendations.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.