Executive Summary
The Yoba campaign is a sophisticated malware operation targeting users interested in AI desktop applications like ChatGPT and Claude. Attackers use SEO poisoning and fake GitHub repositories (e.g., GPT-5.6 Sol, GPT-6 Astra) to lure victims into downloading ZIP archives containing legitimate signed binaries bundled with malicious DLLs. This allows the threat to bypass traditional security checks via DLL sideloading.
Technically, the infection chain utilizes YobaDropper and YobaLoader, which employ anti-analysis features such as geolocation fencing (excluding CIS countries), long sleep cycles (up to 12 days), and process name verification. The malware uses Telegram and a Domain Generation Algorithm (DGA) for command-and-control (C2), ultimately leveraging Google's DNS-over-HTTPS (DoH) to retrieve final payloads, which typically include the XMRig cryptocurrency miner.
This campaign highlights the continued risk of supply chain-style attacks on trusted hosting platforms like GitHub. The impact is primarily unauthorized resource consumption via cryptomining, but the flexible C2 architecture using DNS TXT records allows for the delivery of more destructive payloads if the actors pivot their objectives.