Everybody wants the newest AI model on their desktop, and attackers know it. Check Point Research published a campaign on October 27 they call Yoba, and it uses a trick I'd call cheap and effective: ship the real, signed OpenAI or Anthropic installer, and put a malicious DLL right next to it.
The Lure
Fake GitHub projects and GitHub Pages sites advertised desktop apps for models with names like "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus." Check Point says the pages ranked well in Google, which points to SEO poisoning. The repos were created in July, and the malicious releases went up on August 30, August 31, and September 4.
If you're searching for a model that sounds new and exciting and a GitHub page shows up with a download button, a lot of people will click. That's the whole play.
The Trick: A Real Signature
Each ZIP contains a legitimate, signed OpenAI or Anthropic executable renamed to Setup.exe, plus a malicious winmm.dll sitting beside it. When Windows runs the signed binary, it loads the DLL from the same folder. That's classic DLL sideloading, which Check Point fairly calls a trick from the past.
Why it works: a lot of people, and some tools, check "is this signed by a real vendor?" and stop there. The signature is real. It just doesn't cover the DLL next to it.
From there, the malware:
- Only runs when its host is named
Setup.exe. Wrong name, and it goes to sleep for about 12.7 days, which outlasts most sandboxes. - Skips CIS-region keyboards (Russian, Belarusian, Kazakh and others), with Ukrainian as an explicit exception.
- Asks for admin rights, drops a loader under
ProgramData, and sets a scheduled task that runs as SYSTEM three minutes after boot. - Finds its C2 in a Telegram profile picture. YobaLoader pulls the image from a Telegram channel, turns its last 50 bytes into a domain, then queries that domain's TXT record through Google's DNS-over-HTTPS. The tasking is signed and encrypted. Change the picture, change the infrastructure.
In the case Check Point observed, the payload was an XMRig cryptominer injected into svchost.exe, mining over Tor and pausing when the user is active. Annoying, not catastrophic. But the loader is generic, and Check Point notes the next wave could deliver anything. An earlier Yoba variant was sideloaded by Cursor.exe back in June, so this crew has been working the AI tools angle for a while.
Credit Where It's Due
None of this is a flaw in OpenAI's or Anthropic's software. Their binaries are doing exactly what Windows binaries do. And the whole campaign was laid out publicly by Check Point with IOCs, which is how defenders get ahead of the next wave.
What To Do
- Get AI apps from the vendor, period. Not from a GitHub repo, not from a search ad, not from a "free desktop" page. If the product name sounds like a model that doesn't exist yet, that's your answer.
- Signed isn't the same as safe. Flag signed binaries running from Downloads or temp folders with unsigned DLLs beside them, especially
winmm.dll. - Watch for new SYSTEM scheduled tasks pointing into
ProgramData, and for odd DNS-over-HTTPS lookups todns.googlefrom processes that have no reason to make them. - Control software installs. Application allowlisting and standard (non-admin) user accounts kill a lot of this before it starts.
- Inspect downloads. ZIPs from GitHub releases are just files from the internet. Sandbox them like any other.
Bottom Line
The AI gold rush gives attackers a fresh lure every week, and the next model name is always one search away. A real signature on a fake installer is still a fake installer. Get your AI tools from the front door.
Source: Check Point Research: Tricks from the Past Deployed via Signed ChatGPT and Claude Binaries