Yoba Malware Spreads via Fake ChatGPT and Claude Installers

Yoba Malware Spreads via Fake ChatGPT and Claude Installers

by

Malware operators are distributing malicious software through fake search engine results for popular artificial intelligence tools like ChatGPT and Claude, using a sophisticated campaign called Yoba that can lead to a total compromise of user computers.

Malware Operators Deploy Legitimate Executables and Poisoned Search Results

  • DLL Sideloading: Attackers use legitimate, digitally signed software executables to sneak secondary malicious files past standard computer security protections.
  • SEO Poisoning: Fraudsters manipulate internet search engine rankings so that malicious download links appear in search results and users download the malicious installers.
  • System Compromise: Security analysts advise treating any machine infected with the Yoba loader as a total security breach capable of running unauthorized system scripts.

How Yoba Exploits Artificial Intelligence Search Demand

The campaign uses massive public interest in frontier language models by establishing deceptive repositories on GitHub. Attackers tag these fraudulent directories with titles mimicking genuine software releases, such as “GPT-5.6 Sol” and “Claude Opus.” Through search engine poisoning, these malicious distribution points are positioned in search results, tricking users into downloading installers bundled with hidden threats. Check Point Research revealed the mechanism behind the vector.

Fake AI Download = MALWARE 😱 Signed ChatGPT/Claude .exe Trick | Yoba Campaign

Investigators note that the systems and applications developed by OpenAI and Anthropic remain entirely uncompromised. Instead, the threat actors bundle genuine, digitally signed executable files from those companies into the malicious installer package. These legitimate binaries serve as vehicles to load secondary dynamic-link libraries containing the malicious payload, circumventing standard defensive validations.

Technical Mechanisms of the Yoba Loader

Once downloaded, the Yoba malware executes routine environmental checks before initiating infection. It verifies the regional language settings and administrative privileges of the host computer to evade automated analysis by security analysts. To achieve persistence, the loader establishes scheduled tasks that wait for inbound commands and secondary module downloads.

The campaign relies on legitimate web services to obscure its infrastructure and retrieve final operational components. Yoba extracts domain configuration data embedded within the profile images of specific Telegram channels. It then queries Google’s public Domain Name System-over-HTTPS protocol to interpret encrypted text records before pulling final executable scripts from public file storage platforms like Catbox.

Preventative Protocols for Software Deployment

To mitigate the risk of falling victim to this type of malware, security experts recommend adhering strictly to official distribution channels. Users must download installer packages directly through the verified channels of software developers rather than secondary repositories. Organizations should restrict administrative privileges for non-essential users and deploy endpoint security solutions capable of intercepting anomalous network communications across every stage of the attack chain.

References

  • Check Point Research. Study on the Yoba malware campaign.

More on Yoba

Downloading the Claude Desktop App? Fake Ones on GitHub Hide Malware

Keep reading

Photo of author

Priya Deshmukh - Senior Editor, Health

Priya Deshmukh Senior Editor, Health Deshmukh is a practicing physician and renowned medical journalist, honored for her investigative reporting on public health. She is dedicated to delivering accurate, evidence-based coverage on health, wellness, and medical innovations.

Tristan Thompson Joins Bitcoin Film Satoshi as Producer

XRP Bollinger Bands Reach Narrowest Point Since August as Analyst Eyes Breakout