Fake ChatGPT and Claude apps install XMRig crypto miner
Fake ChatGPT apps and counterfeit Claude desktop tools are being used to install an XMRig cryptocurrency miner through a malware campaign called Yoba. According to Check Point Research, attackers created GitHub projects advertising supposed applications named GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The downloads instead contain YobaLoader, malicious software that ultimately runs a miner, which uses an infected computer's resources to generate cryptocurrency.
The packages place a malicious Dynamic Link Library (DLL), a file containing code that another Windows program can load, alongside legitimate signed executables associated with OpenAI Codex or Claude. The archive includes a signed file called Setup.exe and a hostile file called winmm.dll. When Setup.exe runs, Windows loads the nearby DLL through DLL sideloading, a technique that abuses the way a legitimate application searches for supporting files. This lets the malicious code start indirectly under a trusted executable, potentially making the package appear less suspicious to users and some security checks. The presence of a signed executable does not make the other files bundled with it safe.
The attackers also created GitHub.io pages describing the supposed software, giving the projects a more convincing public presence. Check Point found indications of SEO poisoning, the practice of manipulating search visibility so malicious pages appear prominently in search results. It did not find evidence that fake-account networks were used to inflate the repositories' popularity. Identified locations included github[.]com/gpt-5-6/sol-free-desktop, gpt-5-6.github[.]io, github[.]com/gpt-5-6/gpt-5-6.github.io, github[.]com/gpt-6-astra/gpt-6-astra.github.io, gpt-6-astra[.]github[.]io, github[.]com/opus-5-0/opus-5-0.github[.]io and opus-5-0[.]github[.]io.
Each repository used a separate Outlook address: edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com and rioprestonlfyx[@]outlook[.]com. Check Point said the upload activity appeared to come from UTC+4, UTC-4 and UTC+3 respectively. The researchers assessed the inconsistent time zones as a likely effort to conceal the operator's actual working location.
The first malicious DLL, which Check Point calls YobaDropper, performs checks intended to frustrate automated analysis. It hashes the name of the executable that launched it and compares the result with the hard-coded value 0xE6C2F326. The required name is Setup.exe, so launching the DLL by itself inside a sandbox, an isolated environment used to inspect suspicious files, causes it to stop. It also performs 200,000 iterations of Sleep(5500), amounting to 12.73 days, and avoids systems using keyboard layouts associated with Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan and Uzbekistan. Tatar is also excluded, while Ukraine is notably absent from the list.
YobaDropper then begins another DLL sideloading sequence involving wmpdmc.exe and ampdui.dll. It copies wmpdmc.exe from the Windows system32 folder into a new WMProcess directory under ProgramData. The dropper extracts and decrypts an embedded payload and writes it into that folder as wmpdui.dll. It establishes persistence, meaning a way to restart after the original installation, through a scheduled task that launches the legitimate executable and causes it to load the malicious payload.
That second component is YobaLoader. It repeats the host-name check, requiring execution by wmpdmc.exe and comparing its hash with 0x552751E3. The loader downloads an image from the Telegram channel t[.]me/yoba_fanclub and uses its final 50 bytes as input for a domain generation algorithm (DGA), a method that automatically creates changing internet addresses. It combines words from three dictionaries with a number from 0 to 999, producing an address in the pattern adjective-noun-verb-digit.dedyn[.]io.
YobaLoader submits that generated address to Google's DNS over HTTPS (DoH) service. DoH carries Domain Name System lookups through encrypted web traffic, while DNS normally connects domain names to internet information. The malware requests a DNS TXT record and receives a Base64-encoded command, a way of representing data as text. After decoding and decrypting the response, it obtains the address files.catbox[.]moe/z5zpy9.dat for the next payload. Check Point said the combination of encrypted DNS and common hosting platforms was intended to make command traffic less visible to passive DNS monitoring and harder for gateway protections to distinguish from ordinary activity.
The downloaded payload is injected into svchost.exe, meaning its code is run inside another Windows process, and starts the XMRig miner. Check Point found evidence that the first GitHub repository appeared around July 2026, although malicious releases were not added until the end of August. Earlier YobaLoader versions excluded only Russia and included extensive checks for debuggers and virtual machines, which analysts use to examine software. Those checks were removed from newer versions.
For site owners and IT teams, the campaign demonstrates why software obtained from search results and public repositories should be verified against the developer's official distribution channel before it is run. For organisations assessing this type of software and infrastructure risk, AEU-I provides security-first IT, infrastructure and consulting. A polished project page, a familiar product name and a correctly signed executable do not establish that an entire download archive is trustworthy.