Fake AI Desktop Apps Used to Deploy YobaLoader Malware
Threat actors exploit AI hype to distribute crypto miners via DLL sideloading techniques.
1AI Brand Impersonation Tactics
Threat actors are distributing malicious software disguised as desktop applications for OpenAI ChatGPT and Anthropic Claude. Projects like GPT-5.6 Sol and Claude Opus are hosted on GitHub to deceive users. These repositories leverage SEO poisoning to rank highly in Google search results, increasing the likelihood of unsuspecting users downloading the infected ZIP archives.
2DLL Sideloading Mechanism
The campaign, dubbed Yoba, utilizes DLL sideloading to bypass standard security protections. By placing malicious files alongside legitimate, signed executables from OpenAI or Anthropic, the malware executes indirectly. This technique masks malicious activity, as the system perceives the execution as part of a trusted process, effectively evading basic signature-based detection mechanisms.
3Sophisticated Anti-Analysis Checks
YobaDropper employs rigorous anti-analysis measures, including a checksum verification that mandates the host executable be named Setup.exe. Furthermore, the malware executes 200,000 iterations of a sleep function, totaling approximately 12.73 days of delay. These tactics are designed to frustrate automated sandbox analysis and delay detection by security researchers monitoring for malicious behavior.
4Geographic Infection Filtering
The malware includes a specific exclusion list for keyboard layouts, avoiding machines in Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. Notably, Tatar is also excluded, while Ukraine is absent from this list. These filters suggest a deliberate effort to avoid infecting systems within specific regions, possibly to minimize local scrutiny.
5Persistence and Payload Delivery
Once the dropper executes, it creates a new directory named WMProcess under ProgramData. It then establishes persistence by creating a scheduled task that triggers the legitimate executable to load the malicious payload. This ensures the malware remains active across system reboots, maintaining a foothold on the victim's machine for long-term cryptocurrency mining operations.
6Command and Control Strategy
The YobaLoader component manages communication by relying on DNS-over-HTTPS (DoH) services and common file-hosting platforms. This approach aims to bypass passive DNS monitoring and gateway-based security protections. By blending command-and-control traffic with regular user activity, the attackers make their malicious communications significantly harder to distinguish from legitimate network traffic patterns during standard monitoring.
7Evolution of the Campaign
While the first GitHub repository appeared in July 2024, malicious releases began in late August. Early iterations of YobaLoader focused exclusively on excluding Russia and featured extensive anti-debugging and anti-VM checks. Newer versions have streamlined these processes, reflecting an iterative development cycle aimed at improving infection success rates while maintaining a low profile.
8Security Implications of AI Hype
The Yoba campaign highlights how attackers exploit the current surge in interest surrounding AI tools to distribute malware. By leveraging trusted platforms like GitHub and mimicking well-known software, threat actors lower the barrier for successful social engineering. Organizations must enhance identity visibility and AI threat readiness to defend against these sophisticated, evolving delivery methods.
Original article: The Hacker News — Fake AI Desktop Apps Used to Deploy YobaLoader Malware