Someone looking for a ChatGPT or Claude desktop app could land on a fake GitHub project, unpack its release and run a real, signed application binary. Check Point Research traced the malicious part to a DLL packaged alongside that binary. The signed executable loads the neighboring file, starting a malware chain the researchers call Yoba. For teams that allow employees to install AI desktop tools, the executable’s valid signature makes the adjacent DLL and the process lineage the investigation’s starting point.

The GitHub lures posed as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point observed repositories, GitHub Pages landing pages and release ZIPs, with the first reported malicious releases uploaded in late August 2026. The researchers found the projects in Google search results and assessed that search optimization probably helped them appear there; they saw no inflated GitHub stars or forks. This is a campaign involving impostor downloads, rather than a flaw in the genuine ChatGPT or Claude desktop apps.

A signed app loads the sidecar

The ZIPs put a malicious winmm.dll next to Setup.exe. The ChatGPT-themed packages use a legitimate signed OpenAI executable as the host; the Claude-themed package uses a legitimate signed Anthropic executable. Windows DLL loading supplies the attacker’s code when the host runs. Check Point calls this first stage YobaDropper. Its executable-name check expects Setup.exe; on an unsuitable analysis host it delays execution repeatedly, which can frustrate short sandbox runs.

The dropper asks for administrator privileges, creates C:\ProgramData\WMProcess, copies WMPDMC.exe from System32 into that directory and places its decrypted second stage beside it as wmpdui.dll. It then registers a boot-triggered scheduled task, delayed by PT3M, to run the copied executable as S-1-5-18 (Local System). Check Point observed the task presenting its author as Microsoft Corporation and its description as “Collects device metadata for Windows Media Player.” That apparent Microsoft task runs an attacker-placed DLL next to a real Windows executable.

The loader can change its payload

The second stage, YobaLoader, reads the profile image of a Telegram channel, uses its trailing bytes to derive a domain and looks up a DNS TXT record through Google’s DNS-over-HTTPS service at dns.google. The answer points it to an encrypted file on the legitimate shared host files.catbox.moe. The operator can change the Telegram image and the signed DNS tasking to rotate the destination or select a different payload. A block on a single generated domain therefore has a short useful life.

Check Point observed an XMRig miner in the injected process svchost.exe, using Tor for its mining connection. The researchers put the scope plainly: “Although we observed an XMRig cryptominer as the final payload in this campaign, the YobaLoader is a generic loader.” Their analysis also describes loader options to run a downloaded executable or PowerShell script; those are capabilities, while the miner is the payload they observed. The loader abuses shared Telegram, Google DNS and Catbox services to carry its tasking and encrypted file.

Hunt the installer and task

Start with Windows endpoints where someone downloaded a purported ChatGPT or Claude desktop ZIP from a GitHub release. Preserve the archive and inspect its contents and execution history. A signed Setup.exe immediately beside winmm.dll is the useful pairing; Check Point lists a YobaDropper sample hash of 17e8639a00bb32b10cb9cf0d292e9441456ce4bb. Its second-stage list includes a YobaLoader sample hash 22661f4bada8167fa0f410b75e53184998990abb. Match file hashes where available, then use the process and file path for variants.

Inspect scheduled tasks that execute C:\ProgramData\WMProcess\WMPDMC.exe and the neighboring wmpdui.dll. Microsoft documents Windows Security event 4698 for task creation: its TaskName and TaskContent fields carry the name and task XML, including the action and principal. Search collected 4698 events for this command path and the reported PT3M delay, and inspect the present task definition as well. A task’s displayed author is metadata supplied at registration; the executable path and adjacent DLL matter more. Event-based hunting depends on task-creation auditing and retained logs, so check the live task inventory when that history is unavailable.

For network context, the reported Telegram channel is t.me/yoba_fanclub; the DNS lookup shown by Check Point uses calm-piano-floats-313[.]dedyn[.]io via dns.google, and the reported file host is files.catbox.moe. Use those observations to pivot from a host match, while expecting the generated domain and remote object to change. Keep acquisition links out of user-facing triage notes and collect the archive through your incident process.

Replace the download and verify hosts

For managed Windows devices, restrict unapproved software installation from GitHub releases and direct employees to a vetted app catalog. Anthropic’s official download page offers Windows and enterprise deployment options; use the vendor’s current official channel for each approved desktop app. Isolate and investigate a machine where the reported sideload or WMProcess task ran, remove the unauthorized installation after preserving evidence, and validate that the task and DLL are gone and the approved installer came from your managed source. Verify the adjacent DLL and scheduled task on the endpoint even when the host executable has a valid signature and DNS history has gaps.