Attackers are luring people searching for new AI desktop apps to fake GitHub projects branded as "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus", then using genuine, signed OpenAI and Anthropic installer files to load their malware. Researchers at Check Point Research, who have tracked the campaign for two months and call it Yoba, say the final payload seen so far is a cryptocurrency miner, but the loader behind it can deliver anything its operator chooses.
The lure works because nothing about it looks unusual. The repositories sit on real GitHub infrastructure, with GitHub Pages sites describing the "apps" and malicious ZIP files hosted as ordinary releases. Check Point found no fake stars or forks inflating the projects inside GitHub, yet they still ranked among top Google results, which the researchers attribute most likely to SEO poisoning.
A signed installer does the dirty work
Each archive contains a legitimate, signed Setup.exe from OpenAI (or, in the Claude-branded package, from Anthropic) sitting next to a malicious winmm.dll. When the victim runs the installer, Windows loads the attacker's DLL instead of the real system library, a trick called DLL sideloading that lets malware borrow a trusted program's reputation. Check Point spotted the bad file by its compilation timestamp: it was built the same day it was added to the archive, while the other files predate it.
The ZIPs were not even password-protected, which is unusual for malware hosted on legitimate platforms. The researchers say the attackers did not need to bother, because anti-analysis checks already kept detection rates very low. The dropper only proceeds when it runs under the expected file name; otherwise it sleeps for roughly 12.7 days. It also skips machines with keyboard layouts from Russia and other CIS countries (Ukrainian is explicitly left off that list), and demands administrator rights before it continues.
No command server to block
Once running, the dropper (YobaDropper) copies a genuine Windows Media Player component into ProgramData, drops a second-stage DLL beside it and registers a scheduled task, posing as Microsoft, that runs as Local System three minutes after boot. That second stage, YobaLoader, never talks to a dedicated command server. It reads the profile picture of a Telegram channel, uses the last 50 bytes of the image to generate a domain name under dedyn[.]io, then asks Google's DNS-over-HTTPS service for a TXT record at that domain. The record holds a signed, encrypted instruction pointing to the payload on the Catbox file host. Changing the channel's picture is enough to move the whole operation.
In the samples Check Point analyzed, the payload was the XMRig miner, injected into svchost.exe and routed to an onion mining pool over Tor, pausing whenever the user was active. The loader also supports dropping and running an executable or a PowerShell script, so the researchers warn that future waves may carry different malware. An earlier version seen in early June 2026 was sideloaded by a process named Cursor.exe, suggesting the same developer previously used a fake Cursor AI coding tool as bait.
Check Point says the actor shows indicators that suggest Russian origins and appears to work mainly in the UTC-4 time zone, while the three GitHub accounts used email addresses and commit time zones that varied, likely to blur that picture. The researchers have not tied the activity to a known group.
Get AI apps only from the vendor's own site
Model names such as "GPT-6 Astra" on a GitHub release page are a red flag in themselves. Defenders can hunt for winmm.dll loaded by an installer from outside System32, a ProgramData\WMProcess folder, a scheduled task describing itself as collecting device metadata for Windows Media Player, and DNS-over-HTTPS lookups of dedyn[.]io names from non-browser processes. Fake AI tools have become a steady lure, as with the fake Claude ads hidden behind Bing links and the stealer that raids AI app credentials.
Indicators
- Telegram channel: t[.]me/yoba_fanclub
- Payload host: hxxps://files[.]catbox[.]moe/z5zpy9[.]dat
- Tor obfs4 bridges: 51[.]89[.]231[.]85:24526, 51[.]89[.]228[.]250:21668
- Mining pool: 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443
- GitHub uploader emails: edwardcarlsonmkym[at]outlook[.]com, daxschneiderdjuu[at]outlook[.]com, rioprestonlfyx[at]outlook[.]com
- Release archives: sol-setup.zip, GPT-6-Astra-Setup.zip, Setup-Claude.zip
The trick at the heart of Yoba is old, as Check Point's own title says. What is new is the borrowed signature on the front door, a reminder that a signed file proves who built a program, not what that program will load.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.