al-ice.ai

Search "Claude Desktop", Get a Miner: Check Point's Yoba Campaign Hid Malware Next to Signed AI Binaries

Agent & Supply Chain Security by al-ice.ai Editorial

Hunger for AI desktop apps is now a delivery channel. Check Point Research, publishing 27 October 2026, describes a two-month-tracked campaign it calls Yoba: fake GitHub projects posing as desktop builds of GPT-5.6 Sol, GPT-6 Astra, and Claude Opus — complete with GitHub.io landing pages and ZIP releases — that bury a malicious DLL next to the legitimate, signed OpenAI or Anthropic executable so it loads on launch. The chain ends, in this wave, with an XMRig cryptominer. But the loader underneath can run any executable or PowerShell the operator sends, which is the part to take seriously.

The distribution is the story as much as the malware. The repositories, first committed in mid-July with malicious releases uploaded 30–31 August and 4 September, show no fake stars or forks — yet they rank among top Google results through SEO poisoning of titles, descriptions, and hosting domains. The archives were not even password-protected, the usual trick for defeating automated unpacking: they did not need to be, because anti-sandbox and anti-analysis techniques already held detection rates near the floor. Check Point is explicit that neither OpenAI nor Anthropic was compromised — the attackers simply ship the vendors' real signed binaries as camouflage and let the operating system's own DLL search order do the rest, a classic sideload that sails past signature-based trust. If your mental model is the trojanized Claude Code marketplace build — legitimate identity, poisoned contents — Yoba is the mirror image: legitimate binary, poisoned neighborhood.

Infrastructure designed to have nothing to block

Yoba's operational security is deliberate. There is no dedicated command-and-control to seize or sinkhole: the second-stage YobaLoader visits a Telegram channel (yoba_fanclub), downloads the channel's profile picture, and derives a domain name from part of the image — so the operator migrates infrastructure by changing a picture. That domain is resolved over Google's DNS-over-HTTPS, returning an encrypted, verified record pointing at a file on Catbox. Passive DNS monitoring sees an HTTPS request to Google; gateway controls see a file-hosting download; domain blocks chase a moving target. On the host, the dropper skips machines with Russian or other CIS-region keyboard layouts (Ukrainian explicitly not excluded), takes administrator rights, and installs a scheduled task running as Local System three minutes after each startup — authored, cosmetically, by "Microsoft Corporation" as a "Windows Media Player" task. The miner injects into a Windows process, talks to its pool through Tor, and politely pauses while the user is active. An earlier dropper version dates to early June, so this capability has been iterating for months.

The miner is the least interesting part

Treat XMRig as a placeholder. Check Point warns that organizations finding Yoba should handle the infection as a broader compromise and look past the miner — because the same loader that fetched a miner today fetches ransomware or an infostealer tomorrow, and the same SEO-poisoned GitHub surface that served fake Claude builds serves whatever brand is hot next. The defensive lesson cuts two ways. For users and IT: there are no official desktop builds at these URLs, and "signed executable in the archive" proves nothing about the archive — verify the publisher channel (GitHub release from the actual vendor org, vendor download page), not the signature on one file inside it. For platform owners: fake AI-tool repos with real-infrastructure hosting and no engagement manipulation are nearly indistinguishable from community projects by reputation signals alone, which is why the Google ranking — not GitHub search — did the work. This pairs with the month's other developer-workstation hunts, from Warden Stealer harvesting agent configs to TrapDoor's assistant-config hijacks: the AI developer's machine is now the highest-density target on the network, and attackers are approaching it from every direction at once.

What to do

  • Download AI tools only from vendor channels. No GPT-5.6 Sol, GPT-6 Astra, or Claude Opus desktop build exists outside official OpenAI/Anthropic distribution. Treat any GitHub-hosted "desktop app" for a hot model as hostile until proven otherwise.
  • Hunt the persistence, not the miner. Look for SYSTEM scheduled tasks masquerading as media-player maintenance and unexpected DLLs beside AI-branded executables. Finding Yoba means reimaging and credential rotation, not just killing XMRig.
  • Watch the egress that blends in. DoH to public resolvers plus file-hosting downloads plus Tor is the shape of this C2. Telegram-channel-derived domains will not appear on threat feeds before first use.
  • Enforce application control on DLL loads. DLL sideloading next to a signed binary is an old technique that keeps working because allowlists trust the signer. Monitor or block loads from unexpected paths beside trusted executables.

Sources: