The Yoba malware campaign is tricking people into downloading fake ChatGPT and Claude desktop apps from GitHub, then quietly installing a cryptocurrency miner on their Windows PC. Check Point Research published the findings on October 27, 2026. The files even carry real OpenAI and Anthropic signatures, which is why they can look safe.
Neither company was hacked. The attackers simply borrowed signed files and wrapped them in a malicious package.
Here are the quick facts:
- Who is at risk: Windows users who search Google for a desktop version of ChatGPT or Claude.
- Where the fakes live: GitHub repositories and GitHub Pages sites, with ZIP files on GitHub releases.
- Final payload seen so far: XMRig 6.26.0, a cryptocurrency miner that pauses while you are using the PC.
- Bigger worry: the loader can fetch other programs, so treat an infection as a full compromise.
Why this matters: a quiet miner is the mild outcome. The same delivery chain could carry something far worse.
How the fake AI installers fool you
The lures use names that sound new and exciting, such as “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.” Per Check Point’s report, victims reach the repositories through Google Search. Check Point calls this likely SEO poisoning but did not fully confirm it.
Inside each ZIP is a genuine, signed OpenAI Setup.exe or a signed Claude executable. Next to it sits a malicious winmm.dll. When you launch the real program, Windows loads the bad DLL from the same folder. That trick is called DLL sideloading.
The key point is that a digital signature only vouches for the one signed file. It says nothing about the other files packed beside it.
What the Yoba malware does after you click
The first stage, called YobaDropper, is picky. It checks that the expected Setup.exe launched it, waits around, runs language checks and demands administrator rights. Those hurdles help it dodge security sandboxes.
If you grant admin rights, it drops a loader named YobaLoader next to a legitimate Windows executable. According to Gridinsoft’s analysis, it uses a copy of WMPDMC.exe and a malicious wmpdui.dll in a WMProcess folder. A scheduled task then runs it as SYSTEM about three minutes after each boot.
To find its server, the loader reads a Telegram channel’s profile picture to work out a domain. It then asks Google’s DNS-over-HTTPS service for a TXT record and downloads an encrypted payload from a file host. Swapping the picture changes the domain, so simple blocklists struggle.
Signs your PC may be infected
A miner that pauses while you work is easy to miss. Fans spinning when you step away, or a hot, sluggish laptop at idle, are the usual clues. Use this table as a checklist.
| Sign | What to look for |
|---|---|
| Download source | A GitHub release ZIP or GitHub Pages site, not the vendor’s own site |
| Odd product names | “GPT-5.6 Sol,” “GPT-6 Astra,” or “Claude Opus” as a standalone desktop installer |
| Extra file in the ZIP | A winmm.dll sitting next to a signed Setup.exe |
| Admin prompt | The installer insists you rerun it as administrator |
| Leftover folder | %ProgramData%\WMProcess holding WMPDMC.exe and wmpdui.dll |
Gridinsoft notes that a quiet system does not prove you are clean, so check the folder and scheduled task even if the PC feels normal.
What to do if you ran one of these installers
If you only downloaded the ZIP, delete it without opening it. You are fine.
If you ran the installer, act as if the PC is compromised. Take it offline first, then follow the steps below.
- Disconnect from Wi-Fi and Ethernet so the loader cannot fetch more files.
- Run a full scan with a trusted anti-malware tool. Try Safe Mode if the scan will not start.
- Look for the
WMProcessfolder and the boot-time scheduled task, but do not delete genuine Windows DLLs just because the names match. - Change passwords for email, banking and AI accounts from a different, clean device.
Why this matters: the loader can run PowerShell scripts and other programs, so passwords saved in your browser may be at risk. If the PC holds work data, tell your IT team. A clean reinstall of Windows is the safest fix when you are unsure.
How to download AI apps without getting burned
Go only to the vendor’s own site or your official app store. Type the address yourself rather than trusting a search result, and be wary of any “new model” installer from an unknown GitHub account.
Limit daily use to a standard Windows account so a rogue installer cannot get admin rights with one click. This is the same lesson from our look at the AGENTS.md attack: files you download are untrusted until proven otherwise. Microsoft’s approach to execution containers in Windows 11 points the same way.
Frequently Asked Questions
Were OpenAI or Anthropic hacked in the Yoba malware campaign?
No. Check Point says the attackers reused legitimately signed executables and the brands’ good name. The vendors’ own systems were not breached.
Is there an official ChatGPT or Claude desktop app for Windows?
Yes, both companies offer their own apps, but only through their official websites or stores. A random GitHub ZIP is not one of them.
Does a valid digital signature mean a file is safe?
No. A signature covers only the signed executable. Attackers can pack it with a malicious DLL that the program loads on its own.
How do I know if a cryptominer is running on my PC?
Watch for high CPU use at idle, loud fans and heat. Then check Task Manager, scheduled tasks and the WMProcess folder, and run a full malware scan.
The safest habit is the boring one: skip the “GPT-6 Astra” download, get your apps from the official source, and keep admin rights for real installs only. If a new AI app shows up in search before the vendor announces it, assume it is a trap.
Leave a Reply