Yoba Malware Exploits AI Branding for DLL Sideloading Attacks
Attackers leverage fake AI desktop apps to deploy stealthy cryptocurrency miners via GitHub.
1Sophisticated AI Lure Strategy
The Yoba campaign exploits the popularity of generative AI by hosting fake desktop applications on GitHub. Projects mimicking tools like GPT-6 Astra and Claude Opus appear legitimate to users. Attackers utilize SEO poisoning to ensure these malicious repositories rank highly in Google search results, effectively tricking victims into downloading infected ZIP files.
2DLL Sideloading Mechanism
Each ZIP archive contains a legitimate, signed executable from OpenAI or Anthropic alongside a malicious winmm.dll file. By placing the malicious DLL next to the signed binary, the attackers achieve DLL sideloading. This technique bypasses standard security protections, as the system trusts the signed executable to load the accompanying library during the initialization process.
3Advanced Evasion and Persistence
The YobaDropper performs strict environment checks, including verifying the process name is Setup.exe and excluding specific CIS countries. To maintain persistence, the malware creates a scheduled task disguised as a Microsoft Windows Media Player update. This task runs as Local System, ensuring the malicious payload executes automatically three minutes after every system boot.
4Decentralized Command Infrastructure
Instead of using traditional command servers, the YobaLoader fetches instructions from a Telegram channel profile picture. The last 50 bytes of the image seed a domain generation algorithm for dedyn.io. By querying Google’s DNS-over-HTTPS service for TXT records, the malware retrieves encrypted links to secondary payloads, effectively hiding its traffic from passive monitoring.
5Cryptocurrency Mining Operations
The final payload is an XMRig 6.26.0 miner configured to communicate via a local Tor SOCKS5 proxy. It consumes approximately 85% of CPU threads to maximize mining efficiency. The miner includes logic to pause operations during user activity, resuming only after 240 seconds of inactivity to avoid detection by the system owner.
6Evolution of the Campaign
Earlier versions of Yoba, observed in June 2026, utilized different sideloading targets like Cursor.exe and relied on .aber.ir domains. The current iteration has refined its evasion techniques, dropping previous anti-debugging checks while adopting more complex DNS-based tasking. This indicates an active development cycle aimed at improving stealth and long-term viability for the attackers.
7Detection and Mitigation Tactics
Security teams should monitor for suspicious WMPDMC.exe instances located within the ProgramData folder. Defenders must also investigate scheduled tasks masquerading as Microsoft metadata collectors and analyze network traffic for connections to Telegram or dns.google. High CPU usage without clear justification remains a primary indicator of an active Yoba miner infection on endpoints.
8Broader Security Implications
The Yoba campaign highlights the risks associated with unverified AI tools hosted on trusted platforms like GitHub. By combining legitimate software signatures with malicious DLLs, attackers successfully lower the barrier for infection. Organizations must enforce strict software installation policies and prioritize user awareness to mitigate threats posed by these sophisticated, AI-themed social engineering lures.
Original article: Security Affairs — Yoba Malware Exploits AI Branding for DLL Sideloading Attacks