"The fake projects impersonated artificial intelligence (AI) applications including GPT-5.6 Sol, GPT-6 Astra and Claude Opus." Check Point researchers reported that detail on October 27, tying a multi-month campaign to a simple, effective lure: downloadable desktop applications that appear to be legitimate AI clients but carry hidden malware.
The lure: GitHub repositories, Pages landing sites and SEO poisoning
Check Point said it has tracked the campaign, which it calls Yoba, for roughly two months, with an earlier variant posing as the Cursor coding agent visible in early June. The attackers published releases in GitHub repositories and created GitHub Pages landing pages for the fake projects. Some of those repositories surfaced among Google's top results — an outcome Check Point characterizes as most likely produced by search engine optimization (SEO) poisoning. In short: publicly visible, plausible downloads were positioned where users searching for AI desktop clients could find them.
Signed binaries used as camouflage: OpenAI and Anthropic executables
Rather than shipping entirely new executables, the campaign bundled legitimate, signed OpenAI and Anthropic desktop executables with a malicious dynamic link library (DLL). Check Point observed signed Setup.exe files that loaded the malicious component via DLL sideloading — a technique that abuses the normal Windows loading order to get a malicious DLL loaded into a trusted process. By wrapping malicious code with already-signed binaries, the attackers gained a degree of implicit trust from endpoint controls that look for valid signatures.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageYobaDropper: environment checks, targeting and persistence
The malicious DLL, which Check Point calls YobaDropper, performed multiple environment checks before deploying a second-stage loader. It verified the name of its host process and whether it had administrator privileges; it inspected keyboard layouts to avoid machines in Commonwealth of Independent States (CIS) countries other than Ukraine; and it used lengthy sleeps intended to frustrate automated analysis systems. Check Point said the actor showed indicators suggesting Russian origins.
After passing those gates, the dropper created a directory under ProgramData, copied a legitimate Windows executable into that directory, and used Scheduled Tasks to establish persistence. The task ran under the Local System account and was disguised as a Microsoft task — a common technique to hide activity under a familiar system label.
YobaLoader: Telegram images, DoH, and a generic loader design
The second-stage component, YobaLoader, avoided traditional command-and-control servers. Instead, Check Point found the loader used Telegram and encrypted Domain Name System lookups — DNS-over-HTTPS (DoH) — to obtain instructions. The loader took an image from a Telegram channel, extracted data from it to feed a domain generation algorithm, then queried Google's DoH service for encrypted data stored in DNS records. Those records were cryptographically validated before the loader retrieved and decrypted the next-stage payload.
In the observed instances the payload was an XMRig cryptominer, but Check Point emphasized that YobaLoader is a generic loader: future waves could deliver other executable payloads or PowerShell scripts.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: The campaign demonstrates how signed, legitimate binaries can be abused to bypass controls; defensive teams should prioritize controls that restrict execution paths and watch for DLL sideloading behaviors and scheduled tasks created under ProgramData with Local System privileges.
- Procurement leaders and maintainers of software catalogs: Check Point's findings underscore the risk of accepting or linking to downloads from unverified repositories. Even familiar brand names (OpenAI, Anthropic) can be mimicked when attackers bundle signed executables alongside malicious DLLs.
- End users and administrators: The report recommends caution when installing AI desktop applications from unverified sources and advises restricting execution of software obtained from unknown repositories. The use of Telegram and DoH for stealthy instruction delivery also means standard network filtering may miss these callbacks unless teams specifically monitor for them.
The Yoba campaign is a concise demonstration of two trends working together: social engineering that lures users to supposedly reputable download pages, and technical evasion that leverages legitimate signed binaries and unconventional command channels. Check Point's October 27 research paints a picture of an adaptable loader infrastructure that today mines cryptocurrency but could be repurposed for broader intrusions tomorrow. Organizations that rely on public repositories for software distribution — or that allow routine installation of third‑party desktop clients — will need to treat those sources as untrusted until they adopt tighter controls.
Original report: https://www.infosecurity-magazine.com/news/attackers-hide-malware-behind/
