Check Point Research discovered a campaign tracked as Yoba that exploits the popularity of AI tools by creating fake GitHub projects impersonating ChatGPT and Claude desktop applications. The attackers distribute malware alongside legitimate, signed executables from OpenAI and Anthropic using DLL sideloading to bypass security protections.
Quick Take
- What: Yoba malware campaign uses fake GitHub projects impersonating GPT-5.6 Sol, GPT-6 Astra, and Claude Opus to deliver a custom malware chain via DLL sideloading
- Who is affected: Users searching for ChatGPT and Claude desktop applications who download installers from fake GitHub repositories
- Distribution: Attackers use SEO poisoning to rank malicious GitHub repositories highly in Google search results
- Infrastructure: Campaign avoids dedicated C2 servers, instead relying on Telegram, Tor, Catbox, and DNS over HTTPS
- What to do: Only download AI tools from official vendor websites, not from third-party GitHub repositories
In plain English
Attackers created fake GitHub projects that look like desktop versions of ChatGPT and Claude. When people search Google for these AI tools, the fake projects appear near the top of search results. If someone downloads and runs the installer, it places malicious code next to real, digitally signed files from OpenAI and Anthropic. The malware then loads itself by pretending to be a legitimate part of the software, a trick called DLL sideloading. The attackers communicate through Telegram and Tor instead of traditional hacking servers, making them harder to track.
What you should do: If you use ChatGPT or Claude, only download them from the official OpenAI or Anthropic websites, never from GitHub or other third-party sources.
What happened
Check Point Research tracked the Yoba campaign over two months starting in July 2026. The attackers created fake GitHub repositories impersonating AI desktop applications including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Each repository included a GitHub.io page describing the software’s capabilities and hosted malicious ZIP files as releases.
The repositories did not use fake engagement metrics like inflated stars or forks, but still appeared among top Google search results, likely due to SEO poisoning. Each repository used a different Outlook email address, and uploaders appeared to operate in different time zones (UTC+4, UTC-4, and UTC+3), suggesting deliberate attempts to obscure the threat actor’s true operational timezone.
The first repository was created around July 2026, but malicious releases were not uploaded until late August 2026. The first two releases appeared on August 30 and August 31, 2026, with a third following approximately five days later on September 4, 2026.
Inside the installers, researchers found a malicious component called YobaDropper, which includes another component called YobaLoader. The malware is placed alongside legitimate, signed executables from OpenAI and Anthropic, allowing it to be loaded indirectly through DLL sideloading, a technique commonly used to bypass security protections.
Unlike typical malware campaigns, the ZIP files were not password-protected. Check Point Research notes that malicious files hosted on GitHub are usually password-protected to prevent automated analysis tools from unpacking them, but these binaries already had very low detection rates due to anti-sandbox and other anti-analysis techniques.
The YobaLoader component contacts attacker-controlled infrastructure to fetch the final payload. The campaign demonstrates strong operational security by avoiding dedicated command-and-control infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS.
The two ChatGPT-related releases created five days apart contained mostly the same files, including the malicious components, and maintained the same indicators of compromise. The actor behind the campaign shows indicators suggesting Russian origins.
What you should do
Only download ChatGPT, Claude, and other AI tools from official vendor websites. Do not download AI desktop applications from GitHub repositories or third-party sources, even if they appear in top Google search results.
If you have downloaded any installers claiming to be GPT-5.6 Sol, GPT-6 Astra, or Claude Opus from GitHub, do not run them. If you have already run such installers, disconnect the affected system from the network and seek professional incident response assistance.
What it means
This campaign demonstrates how attackers exploit the popularity of AI tools to distribute malware. By using legitimate GitHub infrastructure and SEO poisoning, the attackers make their malicious projects appear trustworthy to potential victims.
The use of DLL sideloading alongside legitimate signed binaries from OpenAI and Anthropic is particularly concerning, as it allows the malware to bypass security protections that would normally block unsigned or suspicious executables.
The campaign’s strong operational security, including the use of Telegram, Tor, and DNS over HTTPS instead of traditional command-and-control servers, makes it more difficult for security researchers and law enforcement to track and disrupt the operation.
