Fake GitHub downloads impersonate AI desktop apps

Check Point says Yoba impersonates AI desktop applications named GPT-5.6 Sol, GPT-6 Astra and Claude Opus.[1] The projects use real GitHub infrastructure, and their phishing landing pages link directly to malicious ZIP releases hosted on GitHub.[1] The repositories still appeared among Google’s top results, according to Check Point.[1] Check Point also says the repositories did not rely on artificially inflated stars or forks.[1] The combination means that a familiar hosting platform or visible search result is not, by itself, proof that a download is genuine.[1]

According to Check Point, the ZIP packages place legitimate, signed OpenAI or Anthropic executables beside a malicious DLL named winmm.dll.[2] The DLL is loaded through DLL sideloading, a technique in which a legitimate application loads a malicious library.[3] Check Point calls the first malicious component YobaDropper and says it includes a second component, YobaLoader.[1] The presence of a signed executable therefore does not establish that every file in the same download is safe.[2][3] For review processes, assess the complete package and its source rather than treating a valid signature on one file as approval of the bundle.[2][3]

In the attacks Check Point observed, the final payload was an XMRig cryptocurrency miner, which routed its traffic through Tor and paused while the user was active.[3] The loader could also retrieve other Windows executables or PowerShell scripts, so Check Point says later attacks could deliver malware beyond cryptomining.[3] The dropper requires administrator rights before continuing, and Check Point says it waits about 12 days unless launched by a process named Setup.exe.[3] It also skips systems using Russian, Belarusian, Kazakh and other CIS-region keyboard layouts.[3]

With elevated rights, the dropper copies a legitimate Windows Media Player binary into ProgramData and places another malicious DLL beside it.[3] It creates a scheduled task that runs as Local System three minutes after boot and lists Microsoft Corporation as its author.[3] YobaLoader uses a Telegram channel image to help generate a domain name, then queries Google’s DNS-over-HTTPS service for instructions in a DNS TXT record; it retrieves an encrypted payload from Catbox.[3] Check Point identified an earlier Yoba variant observed in June that used a fake Cursor AI coding-agent application.[3] Check Point said indicators suggest Russian origins but did not identify a group behind the activity.[3]