By 
In a striking example of how cybercriminals exploit current trends, a new malware campaign dubbed Yoba has emerged, using the growing interest in artificial intelligence tools as a cover to distribute malicious software. This campaign involves the clever use of fake desktop applications that masquerade as popular AI software, including impersonations of GPT-5.6 Sol and Claude Opus. These impersonations take advantage of legitimate infrastructure, such as GitHub, to appear credible and lure unsuspecting victims.
The campaign was identified by Check Point Research, which dedicated two months to tracking its progress. Yoba relies on convincing fake repositories hosted on GitHub, which boast descriptions and ZIP files that contain both harmful components and seemingly authentic software. Each fake project has a unique repository and a dedicated GitHub.io page designed to attract potential victims through search-engine optimisation—an approach known as SEO poisoning.
At the heart of the Yoba campaign lies a malicious package named the YobaDropper, which installs the malware onto a victim's machine. Each ZIP file unpacks a legitimate signed installer, commonly labelled as Setup.exe from reputable sources like OpenAI or Anthropic, alongside a malicious winmm.dll file. This dangerous DLL is loaded by the legitimate executable through a technique called DLL sideloading, which cleverly bypasses security safeguards.
Interestingly, the installation packages are not locked behind passwords, making them easier for users to execute. This simplification may, however, obscure the fact that the malicious binary is not flagged by security software, due to embedded anti-sandbox mechanisms and unusual compilation dates that don’t match the legitimate files.
Upon execution, the YobaDropper performs checks to ensure it's running within the correct environment, particularly verifying that it was launched by Setup.exe. If these checks are not passed, the malware smartly delays its execution—sleeping for a staggering 12.73 days—until it is run under the right conditions. This tactic is designed to evade automated detection methods typically employed by security systems.
Moreover, Yoba displays a comprehensive sensitivity to its operating environment, making it somewhat selective about whom it targets. This includes avoiding systems set up in certain Commonwealth of Independent States (CIS) countries by verifying keyboard layouts. Notably, the malware makes exceptions for specific nations, excluding others—for instance, while it bypasses Russian and Belarusian targets, it includes none from Ukraine.
Once the installation process successfully elevates itself to administrator privileges, the malicious software creates a new directory named WMProcess within the ProgramData folder. Here, it disguises its secondary payload as another legitimate file called WMPDMC.exe. This layered approach not only enables persistence on the infected system but also ensures that its operations remain concealed from typical user scrutiny.
To maintain its presence, Yoba employs a deceptive task-scheduling technique that mimics legitimate Microsoft processes. It schedules tasks to run three minutes after system boot, convincingly labelled to collect device metadata for Windows Media Player, thus further disguising its malicious intent.
The second stage of the attack is managed by the YobaLoader, which operates similarly to the initial dropper but with additional layers of obfuscation. Rather than relying on traditional command servers, this component uses a Telegram channel to fetch its commands, showcasing a high degree of sophistication. It builds a domain generator based on the last few bytes of a downloadable profile picture from Telegram, effectively morphing its communication pathways and obfuscating its existence from conventional monitoring methods.
The final payload delivered by the loader is typically an advanced cryptocurrency miner named XMRig, which can commandeer up to 85% of CPU resources while remaining in the background. This miner uses encrypted connections to a server via Tor, ensuring that the operator can control its activities with great secrecy. The malware possesses the capability to pause mining activities if user activity is detected, resuming only after the user has been inactive for a specified period.
What makes the Yoba malware particularly unsettling is its flexibility; the infrastructure used allows the operators not only to mine cryptocurrencies but also to potentially distribute other types of malware in future attacks. Previous iterations of Yoba were already using different methods for persistence and were more simplistic in comparison, but the current version demonstrates a concerted evolution in tactics.
Analysts believe that the attackers may have connections to Russian operatives, especially given the specific targeting patterns and methods. However, there is no official attribution regarding their identity, and their operational habits are still being studied.
For individuals and organisations, vigilance is paramount. Cybersecurity professionals are advised to be on the lookout for suspicious copies of WMPDMC.exe in unusual directories, along with any fake Microsoft scheduled tasks and unexpected spikes in CPU usage. Users are encouraged to approach the installation of AI tools, particularly from unverifiable sources or repositories, with caution and to employ stringent policies regarding software execution from unknown origins. By enhancing user awareness and implementing robust technical controls, the threat posed by such sophisticated malware campaigns can be significantly mitigated.
Source: securityaffairs.com
