Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware https://gbhackers.com/yobaloader-malware/
November 4, 2026 at 5:49 AM
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware https://gbhackers.com/yobaloader-malware/
Fake ChatGPT and Claude apps on GitHub sideload DLLs via signed binaries to drop a Tor-routed miner. https://intel.threadlinqs.com/threat/TL-2026-5503?utm_source=bluesky #ThreatIntel #YobaLoader #YobaDropper #xmrig
November 7, 2026 at 10:07 AM
Fake ChatGPT and Claude apps on GitHub sideload DLLs via signed binaries to drop a Tor-routed miner. https://intel.threadlinqs.com/threat/TL-2026-5503?utm_source=bluesky #ThreatIntel #YobaLoader #YobaDropper #xmrig
署名付きOpenAI・Anthropicバイナリ経由のDLLサイドローディングを悪用、ハッカーがマルウェア「YobaLoader」を展開
「Yoba」として追跡されているキャンペーンが、生成AIへの関心につけ込み、偽のGitHubプロジェクトを通じて暗号資産マイニングマルウェアを拡散しています。 Check Point Researchは、約2カ月にわたる追跡調査を経て、2026年10月27日に調査結果を公表しました。 攻撃者は、正規かつ署名付きのOp
「Yoba」として追跡されているキャンペーンが、生成AIへの関心につけ込み、偽のGitHubプロジェクトを通じて暗号資産マイニングマルウェアを拡散しています。 Check Point Researchは、約2カ月にわたる追跡調査を経て、2026年10月27日に調査結果を公表しました。 攻撃者は、正規かつ署名付きのOp
署名付きOpenAI・Anthropicバイナリ経由のDLLサイドローディングを悪用、ハッカーがマルウェア「YobaLoader」を展開
「Yoba」として追跡されているキャンペーンが、生成AIへの関心につけ込み、偽のGitHubプロジェクトを通じて暗号資産マイニングマルウェアを拡散しています。 Check Point Researchは、約2カ月にわたる追跡調査を経て、2026年10月27日に調査結果を公表しました。 攻撃者は、正規かつ署名付きのOp
blackhatnews.tokyo
November 6, 2026 at 9:14 AM
署名付きOpenAI・Anthropicバイナリ経由のDLLサイドローディングを悪用、ハッカーがマルウェア「YobaLoader」を展開
「Yoba」として追跡されているキャンペーンが、生成AIへの関心につけ込み、偽のGitHubプロジェクトを通じて暗号資産マイニングマルウェアを拡散しています。 Check Point Researchは、約2カ月にわたる追跡調査を経て、2026年10月27日に調査結果を公表しました。 攻撃者は、正規かつ署名付きのOp
「Yoba」として追跡されているキャンペーンが、生成AIへの関心につけ込み、偽のGitHubプロジェクトを通じて暗号資産マイニングマルウェアを拡散しています。 Check Point Researchは、約2カ月にわたる追跡調査を経て、2026年10月27日に調査結果を公表しました。 攻撃者は、正規かつ署名付きのOp
Check Point describes Yoba, a campaign using fake ChatGPT and Claude desktop-app projects to distribute YobaLoader and XMRig miners, with DLL sideloading, anti-analysis checks, scheduled-task persistence, and payload injection.
Yoba Campaign Uses Fake ChatGPT and Claude Apps to Deliver Crypto Miners
Check Point describes Yoba, a campaign using fake ChatGPT and Claude desktop-app projects to distribute YobaLoader and XMRig miners, with DLL sideloading…
cyber.hendryadrian.com
October 29, 2026 at 10:12 PM
Check Point describes Yoba, a campaign using fake ChatGPT and Claude desktop-app projects to distribute YobaLoader and XMRig miners, with DLL sideloading, anti-analysis checks, scheduled-task persistence, and payload injection.
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 29, 2026 at 4:05 PM
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 29, 2026 at 4:05 PM
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 29, 2026 at 4:05 PM
Fake AI desktop apps on GitHub deliver YobaLoader via DLL sideloading alongside signed OpenAI/Anthropic executables.
Fake ChatGPT And Claude Apps Abuse Signed Executables To Deploy Crypto Miners - https://mwyr.es/D4o4O7gk #thn #infosec
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Fake ChatGPT and Claude desktop apps on GitHub use DLL sideloading to deploy YobaLoader, which retrieves and executes an XMRig miner.
mwyr.es
October 29, 2026 at 9:48 PM
Fake ChatGPT And Claude Apps Abuse Signed Executables To Deploy Crypto Miners - https://mwyr.es/D4o4O7gk #thn #infosec
🤖 Fake "GPT-5.6 Sol"/"Claude Opus" GitHub repos deliver YobaLoader via DLL sideloading of signed OpenAI/Anthropic EXEs. Hostname-hash gate, ~12-day sleep, CIS locale skips; C2 via Google DoH TXT + DGA → XMRig miner.
https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
October 29, 2026 at 9:28 PM
🤖 Fake "GPT-5.6 Sol"/"Claude Opus" GitHub repos deliver YobaLoader via DLL sideloading of signed OpenAI/Anthropic EXEs. Hostname-hash gate, ~12-day sleep, CIS locale skips; C2 via Google DoH TXT + DGA → XMRig miner.
https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html
Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.
securityonline.info
October 29, 2026 at 8:10 AM
Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
偽ChatGPT・Claudeアプリが署名済み実行ファイルで仮想通貨マイナーを配布。YobaキャンペーンとしてAIデスクトップアプリに偽装し、マルウェアを配布。
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Fake ChatGPT and Claude desktop apps on GitHub use DLL sideloading to deploy YobaLoader, which retrieves and executes an XMRig miner.
thehackernews.com
October 29, 2026 at 6:23 PM
偽ChatGPT・Claudeアプリが署名済み実行ファイルで仮想通貨マイナーを配布。YobaキャンペーンとしてAIデスクトップアプリに偽装し、マルウェアを配布。
Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.
securityonline.info
October 29, 2026 at 8:10 AM
Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
#YobaMalware #DLLSideloading #CheckPoint #ChatGPT #ClaudeAI #GitHubSecurity #Cybersecurity
Fake ChatGPT and Claude installers carry real signatures - and a DLL that quietly mines Monero over Tor. https://intel.threadlinqs.com/threat/TL-2026-4589?utm_source=bluesky #ThreatIntel #YobaLoader #xmrig
October 28, 2026 at 2:52 AM
Fake ChatGPT and Claude installers carry real signatures - and a DLL that quietly mines Monero over Tor. https://intel.threadlinqs.com/threat/TL-2026-4589?utm_source=bluesky #ThreatIntel #YobaLoader #xmrig
~Checkpoint~
Fake ChatGPT and Claude projects on GitHub deliver YobaLoader and an XMRig miner.
-
IOCs: t[.]me/yoba_fanclub, files[.]catbox[.]moe/z5zpy9[.]dat, 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
-
#Malware #ThreatIntel #Yoba
Fake ChatGPT and Claude projects on GitHub deliver YobaLoader and an XMRig miner.
-
IOCs: t[.]me/yoba_fanclub, files[.]catbox[.]moe/z5zpy9[.]dat, 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
-
#Malware #ThreatIntel #Yoba
Yoba Malware Abuses Signed AI Binaries
research.checkpoint.com
October 27, 2026 at 4:07 PM
~Checkpoint~
Fake ChatGPT and Claude projects on GitHub deliver YobaLoader and an XMRig miner.
-
IOCs: t[.]me/yoba_fanclub, files[.]catbox[.]moe/z5zpy9[.]dat, 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
-
#Malware #ThreatIntel #Yoba
Fake ChatGPT and Claude projects on GitHub deliver YobaLoader and an XMRig miner.
-
IOCs: t[.]me/yoba_fanclub, files[.]catbox[.]moe/z5zpy9[.]dat, 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
-
#Malware #ThreatIntel #Yoba