How the fake apps were set up
Attackers spun up GitHub projects dressed as legit desktop AI tools and added GitHub.io pages to sell the story. Examples include github[.]com/gpt-5-6/sol-free-desktop, gpt-5-6.github[.]io, github[.]com/gpt-5-6/gpt-5-6.github.io, github[.]com/gpt-6-astra/gpt-6-astra.github[.]io, gpt-6-astra[.]github[.]io, github[.]com/opus-5-0/opus-5-0.github[.]io, and opus-5-0[.]github[.]io.
The repos were tied to different uploader emails - edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com - with activity patterns aligning to UTC+4, UTC-4, and UTC+3. Check Point said the mismatched time zones likely aim to blur the operator's real working hours. One repo appears to date to around July 2026, with the malicious releases showing up only at the end of August.
The operators did not appear to juice stars or forks with ghost networks, but evidence suggests search results were boosted using SEO poisoning to float these links on Google.
The technical trick: signed executables and DLL sideloading
ZIP archives in the repos carried two key pieces: Setup.exe and winmm.dll. Setup.exe was a genuine, signed OpenAI Codex or Claude binary, and winmm.dll was the malicious piece riding alongside it. As Check Point Research put it, placing malware next to trusted, signed executables lets it load indirectly via DLL sideloading, a common way to slip past defenses.
Once the signed Setup.exe brings in winmm.dll, that DLL operates as a dropper dubbed YobaDropper. It verifies it is being loaded by the right process by hashing the host executable's filename and comparing it to the hard-coded value 0xE6C2F326. That forces execution under Setup.exe and frustrates sandboxes that try to run the DLL alone. It also burns time with 200,000 rounds of Sleep(5500), which adds up to 12.73 days.
The dropper skips systems with keyboard layouts for Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan, and it also excludes Tatar. Ukraine notably is not on the exclusion list.
From there, YobaDropper kicks off another sideloading chain using wmpdmc.exe and ampdui.dll. It copies wmpdmc.exe from system32 into a new ProgramData folder named WMProcess, decrypts an embedded payload, and places it alongside ampdui.dll. For persistence, it creates a scheduled task that starts the legitimate executable so the malicious payload gets loaded.
Knowing which tools you trust is a quiet advantage for long term investors. We're hosting our first ever investor livestream on 11/17 to show you how to use ChatGPT and Claude to invest like a pro, hosted by Briefs Finance CEO Jaspreet Singh. Save your seat.
What YobaLoader does and the final payload
The second DLL is YobaLoader, and it repeats the parent-process guardrail by allowing execution only under wmpdmc.exe, checked via a hash that must match 0x552751E3. It then does three jobs in sequence.
First, it pulls an image from a Telegram channel at t[.]me/yoba_fanclub. Next, it takes the last 50 bytes from the image and derives a domain from them using a word-based routine that yields names in the form adjective-noun-verb-digit.dedyn[.]io. Finally, it calls Google's DNS-over-HTTPS API to retrieve a command, Base64 encoded in a DNS TXT record for that domain, and decrypts it to get the link to the next stage at files.catbox[.]moe/z5zpy9.dat.
Check Point noted, "By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity."
That downloaded payload is injected into svchost.exe, which leads to an XMRig cryptocurrency miner running on the host. Researchers also observed that early YobaLoader versions only excluded Russia and packed in heavy anti-debugging and anti-VM checks, which do not appear in newer builds.
Why this matters for your portfolio
The tactic is simple but effective: bundle malware with recognizable AI names, host it on GitHub, and let trust do the rest. As Check Point summed up, "The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance," and by bundling with well known software names on GitHub, they "lower the chances that users or basic security checks will immediately flag the files as suspicious."
For investors, here is the practical read through: downloads pitched as GPT-5.6, GPT-6, or Claude Opus can contain sideloaded malware that ends with a miner tucked into svchost.exe. That is not just a consumer risk. Any unmanaged download on machines tied to your portfolio's operations can quietly turn into compute drain and security exposure.
Staying curious about emerging tech can help investors find smarter, safer opportunities. On 11/17, our CEO Jaspreet Singh goes live for our first ever investor livestream on how to use ChatGPT and Claude to invest like a pro. Register to join him.
