TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.

TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.