Hackers are spreading malicious Windows installers through fake GitHub projects that resemble ChatGPT and Claude desktop applications. The campaign, known as Yoba, combines legitimate, digitally signed software with malicious DLL files to gain access and deliver additional payloads. Check Point Research revealed this activity on October 27, 2026, after monitoring it for about two months.
The attackers promoted applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus through GitHub repositories and GitHub Pages websites.
Researchers suspect that search engine optimization poisoning may have influenced the placement of these pages in Google results, even though they lacked artificially inflated stars or forks. Trojanized Installers Hijack Windows The downloaded archives contain a legitimate OpenAI or Anthropic executable named Setup.exe alongside a malicious winmm.dll file. A scheduled task launches the executable as Local System three minutes after startup, triggering another DLL sideloading event that activates YobaLoader.
The loader queries Google's HTTPS DNS service for the generated domain's TXT record, verifying the returned instructions with Ed25519 signatures and decrypting them with AES. Three execution options are supported: injecting a payload into svchost.exe, saving and launching an executable, or running a PowerShell script with a hidden window and bypassing execution policies.
