Executive Summary
Check Point Research has identified a sophisticated malware campaign dubbed 'Yoba' that exploits the popularity of AI tools like ChatGPT, Claude, and Cursor. Attackers deploy fake GitHub projects such as 'GPT-6 Astra' and 'Claude Opus' to lure victims into downloading malicious ZIP archives. These archives contain legitimate, signed binaries from OpenAI and Anthropic that are used to sideload a custom dropper and loader chain.
The Yoba malware exhibits high operational security by utilizing Telegram as a seed for its Domain Generation Algorithm (DGA) and leveraging Google’s DNS-over-HTTPS (DoH) for command-and-control tasking. The final stage observed in the wild is an XMRig cryptominer that communicates over Tor to an onion endpoint, though the loader's design allows for the delivery of any arbitrary PE or PowerShell payload.
This campaign primarily affects individuals and organizations seeking desktop AI clients. The actor shows indicators of Russian origin, including specific keyboard layout checks (CIS countries) and operational activity consistent with UTC-4 and UTC+3 time zones.