Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner.

Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The projects look convincing and run on real GitHub infrastructure, which helps them seem legitimate to potential victims.

“These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure.

Inside the installers, there is a malicious component we refer to as the YobaDropper. This dropper includes another component, the YobaLoader, which is responsible for contacting attacker-controlled infrastructure and fetching the final payload.” reads the report. “In this report, we describe how victims are lured to these fake projects, how the YobaDropper and YobaLoader work together, and how the attackers ultimately use this chain to run unwanted software on infected systems.”

The lure is simple. Each project has a repository, a GitHub.io page describing the software, and a ZIP release with the malware. The repositories show no fake stars or forks, yet they still rank among the top Google results, most likely through SEO poisoning that optimizes titles, descriptions and hosting domains.

The first repository appeared around July 2026, but the first malicious releases landed only on August 30 and 31, and a third followed about five days later on September 4. Each repository uses a different Outlook address, and commit times point to UTC+4, UTC-4 and UTC+3, which Check Point reads as a deliberate attempt to hide the actor’s real time zone.

Here’s the trick that gives the report its title. Each ZIP holds a legitimate signed executable from OpenAI or Anthropic, named Setup.exe, next to a malicious winmm.dll. The signed program loads the DLL on its own, a technique known as DLL sideloading, which is often used to bypass security protections.

The ZIP files were not even password-protected. Attackers often use passwords to prevent security tools from automatically unpacking and scanning files. However, these binaries already had very low detection rates because they used anti-sandbox and other techniques to avoid analysis. The DLL’s compilation date is another clue: it was built on the same day it was added to the archive, unlike the legitimate files around it.

The dropper, called YobaDropper, checks the environment before running. It calculates a hash of the name of the program that launched it and continues only if the name is Setup.exe. This means that sandboxes that run the DLL on its own will fail this check. When that happens, the process does not exit. Instead, it sleeps 200,000 times for 5.5 seconds each, a total of about 12.73 days.

The malware also avoids victims in CIS countries by checking the keyboard layout. It excludes Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Tatar. Interestingly, Ukraine, which has often appeared in similar exclusion lists, is not included.

Next, the malware requests administrator privileges. If the user does not have them, it displays the message “Please run this program as Administrator.” and exits. The victim must then restart it with administrator rights.

Once it has the required privileges, the malware creates a folder called WMProcess under ProgramData. It copies the legitimate WMPDMC.exe file from System32 into this folder and places the second-stage payload there under the name wmpdui.dll.

The malicious code achieves persistence by using a scheduled task dressed up as Microsoft. The author is set to Microsoft Corporation, the description says it collects device metadata for Windows Media Player, and it starts three minutes after boot as Local System. The task launches the legitimate program, which sideloads the malicious DLL.

The second stage, YobaLoader, shares code with the dropper, which points to the same developer. It only runs under WMPDMC.exe and uses a different seed for its hashing than the dropper does, which separates the stages and weakens hash-based detection. Its job is to find its payload without a classic command server.

It goes to a Telegram channel, t[.]me/yoba_fanclub, and downloads the channel’s profile picture. The last 50 bytes of the image seed a domain generator that builds names from word lists in the form adjective-noun-verb-number on dedyn[.]io. Change the picture and the operator gets a new domain.

Then it asks Google’s DNS-over-HTTPS service for a TXT record on that domain. The reply is signed, and the loader checks the signature before decrypting it, which gives a link to a payload on Catbox. Check Point says this reliance on DoH and common hosting aims to bypass passive DNS monitoring and some gateway protections, and the campaign avoids dedicated command-and-control infrastructure, using Telegram, Tor, Catbox and DoH instead.

The operator can choose how the payload runs. It can inject it into svchost.exe, save it as an executable after removing the Zone.Identifier mark, or run it as a hidden PowerShell script while bypassing execution policies.

“Finally, the injected payload into svchost.exe is an XMRig 6.26.0 miner with a hidden command line targeting a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy. It can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization.” continnues the report.

The miner uses Tor to connect to an encrypted mining server. It can start its own Tor components, use about 85% of CPU threads, and pause mining when the user is active. It resumes after 240 seconds of inactivity and can load the WinRing0 driver to optimize mining performance.

However, YobaLoader is not limited to cryptocurrency mining. Its DNS tasking system allows operators to deliver any PE executable or PowerShell payload, meaning future attacks could distribute other malware families.

Earlier versions appeared in June 2026. They used Cursor.exe for sideloading, a startup shortcut for persistence, and excluded only Russia. They also used .aber[.]ir instead of dedyn[.]io and included anti-debugging and anti-VM checks that later versions dropped.

Check Point believes the attackers may have Russian origins and mainly operate in the UTC-4 time zone, but this is an assessment, not a confirmed attribution.

Defenders should look for suspicious WMPDMC.exe copies under ProgramData, fake Microsoft scheduled tasks, Telegram-related traffic, DNS lookups for dedyn[.]io through dns.google, and unexplained high CPU usage.

“The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance. By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious.” concludes the report. “Organizations should be cautious about installing “AI helpers” or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources. Combining user awareness with basic technical controls.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Yoba malware)

Threat actors abused fake ChatGPT Custom GPTs and ClickFix to deliver a multi-stage RAT.

ChatGPT’s Custom GPT feature is the latest legitimate surface being turned into a delivery mechanism, and Huntress researchers caught it in action across at least 40 incidents. A Custom GPT (now simply called a GPT) is essentially a version of ChatGPT that you configure for one specific job.

Think of it as creating your own specialist assistant rather than starting from a blank ChatGPT conversation.

The setup is simple and effective. Someone searches Google for “ChatGPT,” clicks a sponsored result, and lands on a Custom GPT page at the real chatgpt.com domain. The page is titled “Plus 5.6,” designed to look like a new ChatGPT model. Interact with it in any way and it responds with a single message: the service is experiencing limited availability on its primary domain, and to continue, you need to visit a “backup domain.” That backup domain is a Google Sites page serving a fake Cloudflare CAPTCHA, and from there it’s a standard ClickFix attack: copy a command, paste it into Windows Run, press Enter. The command is a PowerShell one-liner that downloads and installs a malicious MSI.

“The campaign uses a ClickFix lure to trick victims into running PowerShell, which downloads a malicious MSI and begins a multi-stage, obfuscated infection chain.” reads the report published by Huntress. “The payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code. Huntress investigated at least 40 related incidents, including two confirmed Custom GPT-driven infections.”

Huntress reported the first Custom GPT to OpenAI, and OpenAI took it down on September 25. Just two days later, another GPT linked to the same campaign was already online.

The attack uses eight stages, with each one hiding the next. The PowerShell command uses a decimal IP address instead of the usual dotted format, which Windows accepts but some URL filters may not recognize. It then downloads a 27,000-character script made up of negative numbers. The script decodes itself in memory, so the readable code never gets saved to disk.

It then quietly installs an MSI called ISOSimple.msi. The file pretends to be an “Advanced Printer Configuration Reader” from a publisher called Softplicity and hides itself from the normal list of installed programs. Microsoft Defender detected and quarantined the MSI in at least one case. By that point, however, the malware had already created a Run key and a scheduled task, allowing the attack to continue.

The technical heart of this campaign is DLL sideloading through a legitimately signed Canon application, COTFileReadApp.exe, from Canon’s CaptureOnTouch product.

“COTFileReadApp.exe is a real Canon binary from CaptureOnTouch, and its signature checks out. Its companion, COTFileReadApp.dll, calls into Canon’s logging library, ceiinfolog.dll.” continues the report. “When a program asks for a DLL by name, Windows checks the program’s own folder first, so whatever sits next to the EXE with the right name gets loaded. That’s DLL sideloading, and it’s the door the attackers used.”

The application loads its logging library from its own folder, which is standard Windows behavior. Attackers replaced that logging library with a modified version that still exports the functions Canon expects but also imports one extra DLL that Canon never asked for, rdCore.dll, where the malicious code actually lives. Canon’s binary is genuine and its signature checks out. The logging library looks almost identical to the real one because it mostly is. The only thing that changed is one line in its import table.

From there the chain keeps going. rdCore.dll extracts an encrypted loader from a WAV audio file bundled with the installer. The file has a valid audio header and begins with real audio data, but halfway through the actual sound data stops and encrypted payload bytes start. The WAV header claims the file is about 700KB when it’s actually over 1MB. A rolling XOR cipher decodes the loader directly into memory so nothing readable ever hits the disk, and then the loader goes looking for monitor.raw, a custom encrypted archive that contains 315 folders, 806 files, a persistence script, and the final remote access trojan.

That custom archive is worth pausing on. Somebody built an entire homemade encrypted filesystem just to package and deliver a RAT past automated tooling. Each file in the archive has its own encryption key, the index itself is scrambled with per-entry salts, and none of it is readable without a master key embedded in the loader. Huntress researchers decoded the whole thing by reading the math and reimplementing the decryption, which is a considerably less convenient way to spend your time than the attackers had building it.

The RAT at the end of the chain gives attackers a lot of control. It can run remote desktop sessions, capture the screen, camera and audio, access data from 17 different browsers, search files across the system, and download or run additional payloads in nine formats. It finds its command server through DNS-over-HTTPS using Cloudflare, Google and Quad9, hiding its DNS requests inside normal HTTPS traffic and keeping them out of local DNS logs.

Soon after the Canon-based version appeared, attackers released another version using a binary signed by Stardock. The loader, persistence script and RAT were exactly the same. Only the signed application, file names and hiding technique changed. This time, the loader was hidden inside a genuine Microsoft NuGet package instead of a WAV file.

The delivery script also changed. It now removes the Mark-of-the-Web tag from the MSI before launching it, which gets rid of the warning that the file came from the internet and allows the malware to run without triggering a SmartScreen prompt.

This isn’t the first time AI platforms have been used this way. Huntress has previously tracked attackers abusing shared ChatGPT and Grok conversations to push macOS malware, a sponsored Google result leading to a malicious Claude conversation that deployed a stealer, and a fake Claude Artifact impersonating a Claude Desktop download page. These campaigns typically stay live for hours or days before the provider removes them, which is long enough to hit dozens of people.

The detection advice from Huntress is worth taking seriously: look for PowerShell launching msiexec on a GUID-named MSI in the temp folder, Canon or Stardock binaries running from a fake product folder under AppData, and a Run key or scheduled task that comes back after you delete it. But the bigger point is the last one in the report: ‘Detections tied to Canon or Stardock names will miss the next swap.’

The behaviors carry over between versions. The signed binary changes. The names change. The actual attack sequence, PowerShell to msiexec to signed-app sideload to persistence to RAT, has stayed consistent across every variant Huntress analyzed, and that’s where detection needs to live.

“Overall, threat actors continue to turn trusted platforms into convincing entry points for social engineering, whether via ChatGPT’s Custom GPT feature or through Google Sites for hosting a ClickFix attack.” concludes the report. “This campaign tricked dozens of victims to run PowerShell and install a malicious payload.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ChatGPT Custom GPTs)

Infostealers are exposing corporate AI accounts, sessions and API keys, giving attackers access to sensitive data, compute and connected systems.

SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent rather than the result of historical cleanup. Together, these companies account for 5,434 stealer log records linked to 1,500 distinct corporate email addresses.

The number that really stands out is the ChatGPT figure. A captured ChatGPT or OpenAI session appeared at 358 of the 482 companies, accounting for roughly 90% of all records in the study. Other platforms, including Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs, were far behind.

This doesn’t necessarily point to a security problem with OpenAI. It says more about how employees use AI at work. Many people simply signed up for ChatGPT with a work email and used it on a personal device, often outside company policies and without IT teams even knowing it was happening.

Claude and Gemini barely appear in the data, and SOCRadar is explicit about what that means and what it doesn’t. The researchers read the absence as a shadow-AI signal, not evidence that those platforms are safer to steal from. Anthropic demonstrated that in late August when infostealer malware started hijacking Claude sessions to drain paid usage, forcing a company-wide sign-out, payment method removal, and fraud refunds. Users noticed on Reddit when their usage limits “refilled and then drained” overnight. Claude sessions are targeted the moment they exist in enough volume; there are just fewer of them in corporate environments today.

A stolen AI login is categorically different from a stolen password, and the report makes a clear case for why the industry needs to treat it that way.

“A stolen cookie is a live session. As Okta’s Jeremy Kirk put it, “session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication.”” reads the report published by SOCRadar. “Rotating the password alone leaves the intruder signed in.”

That quote comes from Okta researcher Jeremy Kirk, cited in the report after Okta’s team pulled a 7 GB stealer dump off Telegram and found thousands of still-replayable tokens inside, including two dozen valid API keys for major AI providers. Rotating the password after a credential theft doesn’t help if the active session cookie is still valid. The attacker stays logged in regardless.

The conversation history inside a compromised AI account creates a different kind of breach. Employees often paste source code, customer data, contracts and unreleased plans into AI prompts without thinking of it as data leaving the company. But once an attacker takes over the session, they can access that entire history without ever breaking into the company’s internal systems. The AI account has effectively become part of the company’s corporate memory, and the stolen session provides access to it.

API keys add a financial risk on top of the data exposure. During July, August and September 2026, underground forums were openly offering Claude API keys, ChatGPT cookies from paid and Pro accounts, and Cursor sessions, in some cases with money-back guarantees. This fuels a type of abuse known as LLMjacking: attackers steal keys from notes, configuration files or workspace settings and use them to run AI workloads at the victim’s expense, or resell the access at a discount. The victim gets the bill. The attacker gets the computing power.

“Keys copied into a notes app or a workspace settings page get lifted with everything else, then billed to the victim or resold. Underground vendors sell discounted access to Claude, Gemini and Cursor accounts and money-back guarantees.” states the report.

Automation platforms make the exposure worse. A stolen Zapier session carries standing authorization into CRM systems, email, and file storage. An attacker with access can build a workflow that exfiltrates data on a schedule, from a trusted vendor IP address, without any further credential theft required.

The sector breakdown is worth noting. Technology firms are the largest group at 144 companies and 40% of all records, which matters because those companies hold downstream client data too. But industrials, financial services, healthcare, retail, and energy all appear in force. Agent and automation exposure, the category that carries an employee’s authorization into other systems, concentrates specifically in healthcare, financial services, and technology, which are exactly the sectors least able to absorb that kind of lateral movement.

All of this is happening while the AI industry debates frontier safety risks, autonomous agent swarms, and the pace of development. That conversation is real and worth having. This report is about something more immediate and considerably more actionable:

You don’t need an autonomous swarm to lose your corporate memory. One employee, one unmanaged laptop, one saved ChatGPT password and a commodity infostealer, widely available in Telegram channels since 2022, can be enough.

The controls recommended in the report are straightforward. Put AI platforms behind single sign-on, use short-lived sessions and rotate refresh tokens so stolen cookies expire quickly. Limit and regularly rotate API keys, and flag activity from unusual locations or outside normal working hours. If an employee shows up in a stealer log, treat it as an endpoint security incident, not simply a password reset. And find shadow AI accounts first: you can’t rotate credentials or secure accounts you don’t even know exist.

Anthropic’s own response to the August incident is the template the report points to: the company didn’t just advise a password change, it invalidated sessions, removed payment methods attackers were abusing, and notified affected users that their machines were compromised. That last step is the difference between a data feed and an actual fire alarm.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI accounts)