200,000 iterations of "Sleep(5500)" — a deliberate pause that, when executed, delays observable behavior for roughly 12.73 days before the malicious code proceeds — is one of several built-in tricks used in a campaign that hides cryptocurrency miners inside fake AI desktop apps.
How the Yoba campaign poses as Claude and ChatGPT desktop apps
Threat actors created GitHub projects and github[.]io pages that present themselves as desktop applications for Anthropic Claude and OpenAI ChatGPT — names such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The repositories include ZIP archives that host both a legitimate, signed executable (Setup.exe) and a malicious DLL (winmm.dll).
Check Point Research said the attackers set up the GitHub.io pages to describe capabilities and used SEO poisoning tactics so links surface high in Google results. Check Point listed several repository and site paths observed in the campaign:
- github[.]com/gpt-5-6/sol-free-desktop
- gpt-5-6.github[.]io
- github[.]com/gpt-5-6/gpt-5-6.github.io
- github[.]com/gpt-6-astra/gpt-6-astra.github.io
- gpt-6-astra[.]github[.]io
- github[.]com/opus-5-0/opus-5-0.github[.]io
- opus-5-0[.]github[.]io
DLL sideloading alongside legitimate signed executables
"The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading," Check Point Research wrote. The ZIPs include a bona fide Setup.exe identified as a signed OpenAI Codex or Claude executable and a malicious winmm.dll. Placing a malicious DLL beside a trusted signed executable enables the executable to load the DLL, allowing the malware to bypass some security protections that focus on unsigned binaries.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadYobaDropper: checks, persistence, and an internal sideloading chain
The malicious winmm.dll acts as a dropper (codenamed YobaDropper) and contains several anti-analysis and targeting checks. It computes a checksum of the basename of its host executable and requires that value match the hard-coded 0xE6C2F326 — effectively enforcing that the DLL be launched under "Setup.exe." The check causes the component to fail if executed on its own in a sandbox.
Additional pre-checks include the long sleep loop (200,000 calls to Sleep(5500)) and a keyboard-layout-based exclusion list that avoids machines configured for Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. The droppers also exclude the Tatar language; Check Point noted that Ukraine — which older campaigns sometimes excluded — is not on the exclusion list.
YobaDropper triggers a secondary DLL sideloading chain involving "wmpdmc.exe" and "ampdui.dll." It copies wmpdmc.exe from the system32 folder into a newly created ProgramData\WMProcess directory, extracts and decrypts an embedded payload dropped as "wmpdui.dll," and creates a scheduled task that launches the legitimate executable to load the malicious payload on each run.
YobaLoader, DoH, DGA and the path to an XMRig miner
The second DLL in the chain, YobaLoader, also implements a host-check requiring it to be run by "wmpdmc.exe" (matching a hard-coded hash 0x552751E3). YobaLoader downloads an image from a Telegram channel (t[.]me/yoba_fanclub) and uses the last 50 bytes of that image as a seed to generate domains via a domain generation algorithm (DGA).
The generated domains take the form adjective-noun-verb-digit.dedyn[.]io and are built from three dictionary lists plus an integer from 0–999. YobaLoader then queries Google's DNS-over-HTTPS (DoH) API to retrieve a Base64-encoded command from a DNS TXT record at the constructed domain. The loader decrypts the DoH response to obtain a link — files.catbox[.]moe/z5zpy9.dat — which it fetches as the next-stage payload.
The downloaded payload is injected into svchost.exe and executes an XMRig cryptocurrency miner. Check Point noted the actor relies on DoH and common file-hosting platforms to make command-and-control traffic blend with regular user activity and evade passive DNS monitoring and some gateway protections.
Operational signals: timelines, accounts, and changes over time
Evidence in Check Point's analysis places the creation of the first GitHub repository around July 2026; malicious releases were uploaded at the end of August 2026. The actor used different contact emails in each repository (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, rioprestonlfyx[@]outlook[.]com) and the uploader timestamps indicated activity in UTC+4, UTC-4 and UTC+3 — an inconsistency Check Point said likely reflects deliberate attempts to obscure the operator's true timezone.
Early YobaLoader versions initially excluded only Russia and included extensive anti-debugging and anti-VM checks; those measures were removed from later samples, suggesting iterative development and adaptation by the actor.
What this means for security teams, open-source maintainers, and enterprises
- Security teams and technologists: watch for signs of DLL sideloading next to signed AI-related executables, scheduled tasks that launch legitimate binaries from ProgramData, DoH queries to Google for unusual TXT records, and downloads from channels such as t[.]me/yoba_fanclub and files.catbox[.]moe.
- Open-source maintainers and platform hosts: the campaign demonstrates how github[.]io pages and public repositories can be weaponized with SEO tactics; maintainers should be alert for impersonation and suspicious release artifacts bundled with otherwise legitimate binaries.
- Procurement and enterprise defenders: the campaign shows attackers leveraging trusted names and signed executables to lower initial suspicion; inventories that flag unexpected copies of signed binaries in user-writable locations (ProgramData, user folders) merit attention.
As Check Point Research summarized, "The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance." The campaign's mix of legitimate-signed binaries, long delays, regional exclusions and a DoH/DGA-based command channel highlights a focused effort to blend in and persist long enough to deliver a crypto miner.
