Fake ChatGPT and Claude apps hide a miner beside a signed file

One signed file, one malicious neighbour

Trusting a signed program from a known vendor is a habit this campaign exploits. A signature vouches for one file. It says nothing about what that file loads from the folder beside it.

Check Point Research calls the campaign Yoba. Its team has followed it for about two months. The attackers published GitHub projects presenting themselves as desktop apps named for new AI models: GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point says these are fake projects, not real software. The ChatGPT- and Claude-themed archives pair a legitimate signed OpenAI or Claude executable named Setup.exe with a malicious winmm.dll. The final payload the researchers saw was an XMRig cryptocurrency miner.

How people find the fakes

The attackers used real GitHub infrastructure. Each project had a GitHub.io page describing the software, with download links to ZIP releases hosted on GitHub. Check Point found no fake stars or forks pushing the projects up GitHub's own search.

The projects still ranked among the top Google results. The researchers say this is most likely SEO poisoning. That means the attackers tuned titles, descriptions and hosting domains to rank in search engines.

Check Point describes an SEO-poisoning lure: the fake projects rank high in Google results for AI tools. The report does not name any victim. On timing, the first repository dates to roughly July 2026. Nothing malicious was uploaded until late August, and a third release followed about five days later.

How the trick works

The technique is called DLL sideloading. A Windows program looks for helper libraries in its own folder first. Here, the signed Setup.exe loads a fake helper named winmm.dll, so attacker code runs under a trusted name. Check Point says the other files in the package mostly serve to look legitimate. The fake DLL lists 180 empty exports to imitate the real library, and only its entry point holds working code.

The dropper, which Check Point names YobaDropper, then settles in. It creates a folder called WMProcess under ProgramData and copies WMPDMC.exe, a Windows Media Player file, from System32 into it. It then drops a decrypted payload named wmpdui.dll beside that copy. A scheduled task launches the copy three minutes after startup, running as Local System. The task lists Microsoft Corporation as its author.

The next stage, YobaLoader, gets its orders in an unusual way. It reads the profile picture of a Telegram channel and uses the last 50 bytes of the image to generate a web address ending in dedyn.io. It then asks Google's DNS-over-HTTPS service for a text record. The reply must carry a valid Ed25519 digital signature before the loader acts on it.

In the example Check Point decrypted, the reply pointed to a file on Catbox. The loader has three deployment methods: injecting the payload into svchost.exe, a normal Windows process; running an .exe from the %TEMP% folder; or running a .ps1 PowerShell script. In the miner case, the payload was injected into svchost.exe. The miner runs through a local Tor proxy. Check Point says it can pause mining when it detects user activity.

Changing the Telegram picture changes the address, so a blocklist of domains alone is brittle. The Telegram channel is hard-coded in the loader. The Catbox address is different. It arrives inside the signed reply, which the operator controls, so the one Check Point saw was only an example. Defenders should not rely on it staying the same.

Built to wait and to skip

The malware checks its own file name and continues only if it runs as Setup.exe. A sandbox that runs the DLL alone fails that test. A failed check does not stop the process. Instead, the DLL sleeps for 5.5 seconds, 200,000 times. That is about 12.73 days, according to Check Point.

It also checks the keyboard language and skips machines set to languages from CIS-region countries. Ukrainian keyboards are explicitly not skipped. An earlier loader version excluded only Russia. Later versions moved the check into the dropper and widened it.

The researchers say indicators suggest Russian origins. That is an assessment, not a confirmed attribution. They add that the actor appears to operate mainly in UTC-4. Repository details show mixed time zones, which Check Point thinks is a deliberate attempt to hide this.

One detail is ordinary. If the user lacks administrator rights, the malware shows the message "Please run this program as Administrator." A person installing a new app would find that request unremarkable.

The miner may not be the point

Check Point says YobaLoader is a generic loader. The operator can supply any program or PowerShell script through the signed tasking, so future waves may deliver other malware. The miner is what the researchers saw. It is not necessarily the limit of what the access allows.

The researchers also found an earlier dropper from early June 2026, sideloaded by a process named Cursor.exe. They say it remains unclear whether that file was a legitimate signed binary. Check Point notes the operator kept the same Telegram channel and profile image while changing the loader's evasion tricks.

What this means for leaders

This campaign borrows the popularity of AI tools. If staff install such tools on work machines, that is a path in. A signed file from a known vendor can make the borrowed trust look real.

Check Point advises caution with AI helpers from unverified repositories and policies that restrict software from unknown sources. Leaders can turn that into specific questions for their teams.

First, where may staff get AI desktop tools? Publish an approved list, so nobody has to search for one. Second, do endpoint controls judge a program only by its signature, or also by what it loads? Third, can the team search for a ProgramData\WMProcess folder and for scheduled tasks that run as Local System under a Microsoft author name? Those are details Check Point published.

A signature tells you who made one file. It does not tell you what is standing beside it.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Check Point Research.