GitHub AI tool installers deliver Yoba malware that sideloads signed binaries and mines crypto
The claim
The authors claim that the Yoba campaign uses SEO-poisoned GitHub repositories masquerading as ChatGPT and Claude installers to distribute a dropper that sideloads signed binaries and ultimately runs a cryptocurrency miner.
Published as: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”
So what
Enterprises should block installation of AI helper tools from unverified GitHub sources and monitor for signed binaries being used in unexpected sideloading scenarios.
The five-minute version
Researchers tracked three GitHub repositories posing as AI desktop apps (ChatGPT and Claude) that hosted malicious ZIP releases. The ZIPs contain a dropper (YobaDropper) that sideloads a malicious winmm.dll via a legitimately signed Setup.exe, then a loader (YobaLoader) fetches a payload using a DGA seeded by a Telegram channel image and delivers an XMRig cryptocurrency miner via DoH DNS-TXT commands. The evidence consists of repository commit logs, release timestamps, binary analysis, and observed C2 traffic, but the sample size is limited to a single campaign window.
What undercuts it the paper’s own results
- Earlier variants of YobaDropper used a different DGA suffix (.aber.ir) and injected into a different process, indicating the technique is evolving.
- The analysis only covers three releases and three repositories, so the observed behavior may not represent the full campaign.
Stated limits 3
- Only three repositories and releases were examined; additional samples may exist.
- Some early-variant anti-analysis checks were removed in newer versions, suggesting ongoing development.
- The DGA relies on a specific Telegram channel image; changes to the channel could alter the algorithm.
What’s new here 4
- Use of legitimately signed OpenAI/Claude executables to sideload malicious DLLs
- Domain generation algorithm seeded by the last 50 bytes of a Telegram channel image
- Anti-sandbox check that hashes the process basename and sleeps for 12+ days on mismatch
- Regional targeting based on keyboard layout IDs to exclude CIS countries
Artifacts & methods 10
- YobaDropperprimitive
- YobaLoaderprimitive
- Signed Setup.exe (OpenAI)system
- Signed Claude executablesystem
- winmm.dll spoofprimitive
- DGA seeded by Telegram imageevaluation
- DoH DNS-TXT C2primitive
- XMRig 6.26.0 minerprimitive
- DJB2 hash algorithmtheory
- AES-ECB decryptiontheory