What Check Point found
Check Point Research spent about two months tracking a campaign it named Yoba, which builds fake GitHub projects impersonating AI desktop applications under names like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Each fake project pairs a GitHub repository with a GitHub.io landing page and a downloadable ZIP release. The operators skip the usual trust-inflation tricks, no purchased stars, no fake forks, and instead rely on search engine optimization to rank the repositories highly in Google results for people searching for AI tools. The first repository appeared around July 2026, with malicious releases following in late August and early September.
The payload inside the ZIP is currently a cryptocurrency miner, but the delivery infrastructure is built to hand off other payloads later. Each repository was registered with a different Outlook address, and commit timestamps spanned UTC+4, UTC-4, and UTC+3, which Check Point reads as a deliberate attempt to obscure the operators' actual time zone and location. The campaign's assessed origin is Russian-speaking operators working primarily in UTC-4, though Check Point frames that as an assessment rather than a confirmed attribution.
The trick is abusing trust in signed software
The technical core of Yoba is DLL sideloading against real AI vendor binaries. Each ZIP contains a genuine, signed OpenAI or Anthropic executable named Setup.exe, sitting next to a malicious winmm.dll. When the legitimate signed program runs, Windows loads the attacker's DLL alongside it, a technique that routinely evades controls built around code-signing checks. The archives are not even password protected, yet the binaries carried low detection rates because of anti-sandbox logic layered on top, not obfuscation of the file itself.
That dropper, which Check Point calls YobaDropper, checks the hash of its parent process and proceeds only if it is actually Setup.exe, which defeats sandboxes that analyze the DLL in isolation. If the check fails, it does not exit. It sleeps roughly 200,000 times at 5.5 seconds each, close to 12.73 days, which quietly outlasts almost every automated analysis window security teams rely on. It also checks the system's keyboard layout and skips several CIS countries, though notably not Ukraine, before requesting administrator rights and, if denied, simply asking the user to relaunch as admin.
A command channel with no infrastructure to seize
Once installed with persistence through a scheduled task impersonating a Microsoft Windows Media Player metadata job, the second-stage loader, YobaLoader, does something unusual: it has no traditional command-and-control server for defenders to find and block. Instead, it fetches a profile picture from a Telegram channel and uses the last 50 bytes of that image to seed a domain generation algorithm, producing adjective-noun-verb-number domain names hosted on the dynamic DNS provider dedyn.io.
The loader then queries Google's public DNS-over-HTTPS service for a signed TXT record at the generated domain, verifies the signature before decrypting the response, and follows it to a payload staged on the free file host Catbox. Every component in that chain, Telegram, Google DNS, and common cloud hosting, is infrastructure that security teams allowlist by default and rarely inspect closely. Changing the Telegram image rotates the entire command channel instantly, which makes this campaign nearly impossible to disrupt through domain takedowns or IP blocking alone.
Why a crypto miner is the less interesting part
The actual payload observed so far is an XMRig cryptocurrency miner that throttles to roughly 85 percent of CPU threads, pauses when it detects keyboard or mouse input, and resumes after four minutes of idle time, all tuned to avoid tipping off the user. On its own, that is a nuisance, not a crisis. It costs compute and electricity, and most IT teams would catch it eventually through performance complaints.
What should concern a CISO is the tasking capability sitting underneath it. YobaLoader can deliver any executable or run a hidden PowerShell script that bypasses execution policy, on command, through an infrastructure-free channel that already has a foothold inside the organization. The operators are currently monetizing access cheaply through mining. Nothing about the architecture limits them to that choice, and a loader this resilient is exactly the kind of foothold that gets resold or repurposed once initial access brokers notice it works.
The real story is shadow AI adoption
Every enterprise currently has employees searching for and installing AI tools that IT never approved, because the pace of model releases has outrun procurement cycles everywhere. A developer reads about a new model on a Friday and wants a desktop client running before Monday's standup, long before security or IT has even logged the request. Yoba is the first campaign built specifically to exploit that behavior at scale, using the brand recognition of GPT-5.6 and Claude Opus and legitimate SEO tactics to put itself in front of exactly the people most eager to try the newest model first, and most willing to grant it administrator rights without a second thought.
That targeting choice will not stay unique to Yoba. If impersonating a trusted AI brand reliably gets a malicious installer past both search rankings and antivirus heuristics, every other criminal group tracking this space will copy the approach within a quarter or two. OpenAI and Anthropic did nothing wrong here, their binaries are genuinely signed and clean, and neither company controls what gets packaged alongside them in a third-party ZIP file. The surge in AI tool demand has simply created a trust shortcut, brand recognition plus a real digital signature, that attackers can walk straight through without writing any new malware for the signed half of the chain.
What CIOs should put in place now
Treat AI desktop application installs the same way you treat any other unmanaged software category: route them through an approved internal catalog, block direct downloads of executables from GitHub releases and similar hosts at the endpoint, and make the one approved path to try a new model faster and easier than the risky one, or employees will route around it regardless of policy. The approved path needs real throughput too, a request that takes two weeks to clear procurement will lose to a GitHub search every time, no matter how clear the written policy is.
On the detection side, the indicators Check Point published are concrete and actionable today: look for unexpected copies of WMPDMC.exe under ProgramData, scheduled tasks falsely attributed to Microsoft for Windows Media Player telemetry, DNS queries to dedyn.io resolved through Google's DNS-over-HTTPS endpoint, and unexplained Telegram traffic from developer workstations. None of these require new tooling, only a rule update and the discipline to check for AI-tool installs with the same seriousness applied to any other unvetted download. Developers and data scientists, who tend to have the broadest local permissions and the strongest appetite for trying the newest model first, deserve the tightest version of this policy rather than the loosest one.
