Yoba Malware Campaign Abuses Signed AI Applications to Evade Detection

The Yoba malware campaign distributes cryptocurrency mining malware by abusing digitally signed AI application executables from OpenAI and Anthropic to evade detection. It uses DLL sideloading with malicious DLLs loaded alongside legitimate signed binaries. The infection chain includes YobaDropper and YobaLoader components that employ anti-analysis techniques such as process verification, execution delays, and regional language exclusions. Command and control communication uses Telegram profile images, domain generation algorithms, DNS over HTTPS via Google, and public hosting services to retrieve encrypted payloads. While primarily observed deploying the XMRig miner, the loader architecture can support additional Windows executables and PowerShell payloads, indicating potential expansion beyond cryptojacking.

• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27