Fake ChatGPT and Claude apps spread YobaLoader malware via DLL sideloading

Threat actors are distributing malicious loaders and cryptocurrency miners disguised as desktop applications for OpenAI's ChatGPT and Anthropic's Claude, according to research by Check Point reported by The Hacker News on October 29, 2026. The campaign, dubbed Yoba, relies on fake GitHub projects claiming to offer apps such as "GPT-5.6 Sol," "GPT-6 Astra" and "Claude Opus," whose actual payload is a malware family named YobaLoader.

How it spreads

The Hacker News reports that the attackers created GitHub repositories and GitHub.io pages describing the software's supposed capabilities to appear credible, with signs of SEO poisoning to rank the links highly in search results. Each downloadable ZIP archive contains a legitimate, signed OpenAI Codex or Claude executable named "Setup.exe" alongside a malicious "winmm.dll." When the trusted executable runs, it loads the rogue DLL — a technique known as DLL sideloading — so the malware executes indirectly under the cover of a signed binary. Check Point said the malware is placed "next to legitimate, signed executables from OpenAI and Anthropic."

Technical details

According to the report, the first-stage dropper (the malicious winmm.dll) runs only if the hash of its host executable's name matches a hard-coded value, so it fails in a bare sandbox. It stalls through roughly 200,000 iterations of a sleep call — about 12.7 days in total — and skips machines using keyboard layouts from Russia, Belarus and several other post-Soviet states, though Ukraine was removed from that exclusion list. It then copies a legitimate system binary into a new folder under ProgramData, drops a second DLL and establishes persistence via a scheduled task.

The Hacker News reports that the second-stage YobaLoader downloads an image from a Telegram channel, uses a domain generation algorithm seeded from that data, and queries Google's DNS-over-HTTPS (DoH) API for a TXT record containing a Base64-encoded command, which decrypts to a next-stage URL on the file-hosting site catbox.moe. Check Point said this DoH and file-hosting approach helps the actor "bypass passive DNS monitoring" and makes command-and-control traffic "harder to distinguish from regular user activity." The final payload is injected into svchost.exe and runs the XMRig cryptocurrency miner.

What to do

The Hacker News did not include a formal recommendations section, and the report does not provide victim or download counts. Based on its findings, users should obtain AI tools only from official vendor websites rather than search results or GitHub repositories, and should not treat a valid code signature as proof of safety, since signed binaries can still sideload malicious DLLs. Defenders can watch for system binaries copied into non-system folders such as ProgramData, unexpected DLLs loaded from application directories, scheduled tasks created by unknown processes, DNS-over-HTTPS requests from non-browser processes, and svchost.exe anomalies consistent with XMRig mining.