MalwarePublished 27 Oct 2026

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Source Check Point Research

Description

Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.

Impact

The campaign enables attackers to run unwanted and potentially harmful software on infected systems by tricking users into downloading and executing malicious installers disguised as legitimate AI desktop applications. The use of DLL sideloading with signed binaries helps evade security defenses, increasing the likelihood of successful infection. The malware chain can fetch and execute additional payloads from attacker-controlled infrastructure, potentially leading to further compromise. The campaign's avoidance of traditional C2 infrastructure complicates detection and mitigation efforts.

Defensive guidance

Defenders should educate users to avoid downloading software from untrusted or unofficial sources, especially those impersonating popular AI tools. Monitoring and blocking access to known malicious GitHub repositories and releases, as well as employing endpoint protection capable of detecting DLL sideloading and related techniques, can help mitigate risk. Since the campaign uses decentralized communication channels, network monitoring for unusual DNS over HTTPS, Tor, and Telegram traffic may assist in detection. There is no indication that the malware is mitigated by vendor patches; therefore, user awareness and network defenses are critical.

Summary

The Yoba campaign distributes malware by creating fake GitHub repositories and GitHub.io pages that impersonate popular AI tools. These repositories host ZIP archives containing installers with a malicious dropper (YobaDropper) and loader (YobaLoader) components. The malware uses DLL sideloading by placing malicious DLLs alongside legitimate signed executables from OpenAI and Anthropic to bypass security protections. The campaign avoids dedicated C2 infrastructure, instead relying on decentralized services such as Telegram, Tor, Catbox, and DNS over HTTPS for communication and payload delivery. The attackers use SEO poisoning to rank their malicious projects highly in external search engines, increasing victim exposure. Operational security measures include inconsistent timezone indicators to obscure the actor's true location, with evidence pointing to Russian origins and activity centered around UTC-4. The malicious binaries show low detection rates due to anti-sandbox and anti-analysis techniques.

References

research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2026, 13:12 UTC

Technical details

References

Community reviews

Related threats