Skip to content
Yoba Malware Campaign Exploits AI Tool Popularity via Signed Binaries

Yoba Malware Campaign Exploits AI Tool Popularity via Signed Binaries

First seen 28 Oct 2026, 00:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 02:46 UTC
  • •Yoba malware exploits trust in AI tools by using fake GitHub projects.
  • •DLL sideloading technique is employed to bypass security protections.
  • •Attackers use SEO-poisoning tactics to increase visibility of malicious projects.

Check Point Research has identified a malware campaign named Yoba that exploits the popularity of AI tools like ChatGPT and Claude. Attackers create fake GitHub projects impersonating desktop applications, using legitimate signed executables from OpenAI and Anthropic to load malware through DLL sideloading. The malicious components include the YobaDropper and YobaLoader, which fetch additional payloads from attacker-controlled infrastructure. The campaign employs SEO-poisoning techniques to ensure visibility in search results, targeting users searching for new AI software. Indicators suggest the attackers may have Russian origins, operating primarily in the UTC-4 time zone. The final payload observed includes XMRig, but the YobaLoader can deliver various other payloads. No evidence suggests that the AI platforms themselves have been compromised.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
Yoba malware campaign reported
Check Point Research published findings on Yoba malware exploiting AI tool popularity through fake GitHub projects.
Research.Checkpoint
2026-10-27
Yoba malware campaign reported
Check Point Research detailed the Yoba malware campaign, highlighting its use of signed binaries and SEO tactics.
Blog.Checkpoint

More articles in this cluster (2)

Following this threat?

Track XMRig in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

What AI tools are being targeted?
The Yoba malware campaign targets fake versions of ChatGPT and Claude desktop applications.
How does the malware get installed?
Users are lured to download malicious ZIP files from fake GitHub projects that impersonate legitimate AI tools.
Is there any indication of state involvement?
The campaign shows indicators suggesting possible Russian origins, but no direct state attribution has been confirmed.