Yoba 2026: How Fake AI Apps Used Signed Executables to Mine Crypto Undetected
Executive Summary
Beginning in July 2026, threat actors launched a campaign dubbed 'Yoba' that distributed trojanized desktop applications impersonating OpenAI ChatGPT and Anthropic Claude tools via fake GitHub repositories. Attackers used DLL sideloading against legitimate, digitally signed OpenAI Codex and Claude executables to deploy a multi-stage malware chain—YobaDropper then YobaLoader—ultimately injecting an XMRig cryptocurrency miner into svchost.exe. Command-and-control infrastructure relied on a Telegram-seeded domain generation algorithm and Google DNS-over-HTTPS to evade traditional network monitoring, effectively hijacking victim compute resources for Monero mining while evading most endpoint and gateway defenses.
The Yoba campaign reflects a rapidly maturing attacker playbook: exploiting surging enterprise and consumer interest in AI tools to socially engineer downloads, while layering DLL sideloading, DGA-based C2, and geo-fencing anti-analysis tricks to extend dwell time. As AI application adoption accelerates across industries, defenders face an expanding attack surface where trusted brand names and code-signing status can no longer serve as reliable trust signals.
Why This Matters Now
Enterprises are rapidly deploying AI desktop tools—often outside formal software procurement channels—creating a blind spot that attackers like the Yoba campaign actively exploit. With SEO poisoning surfacing malicious GitHub pages above legitimate results, even security-aware users are at risk. The abuse of signed executables and DNS-over-HTTPS for C2 renders traditional perimeter and endpoint controls insufficient without network-layer egress enforcement and anomaly detection.
Attack Path Analysis
In the Yoba campaign, threat actors created fake AI desktop applications (GPT-5.6 Sol, GPT-6 Astra, Claude Opus) hosted on GitHub with SEO poisoning to lure victims into downloading trojanized ZIP archives containing legitimate signed executables paired with malicious DLLs via DLL sideloading. Once executed, YobaDropper established persistence via scheduled tasks, spawned a second sideloading chain, and YobaLoader used a domain generation algorithm seeded from a Telegram-hosted image and DNS-over-HTTPS queries to resolve C2 commands, ultimately injecting XMRig into svchost.exe to mine Monero cryptocurrency on victim machines.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers distributed trojanized ZIP archives via fake GitHub repositories advertising popular AI tools (GPT-5.6 Sol, GPT-6 Astra, Claude Opus). SEO poisoning surfaced malicious GitHub.io pages at the top of Google search results. Archives contained a legitimate signed OpenAI or Anthropic executable (Setup.exe) alongside a malicious winmm.dll, exploiting DLL sideloading to bypass security controls and appear trustworthy to users and automated scanners.
MITRE ATT&CK® Techniques
Hijack Execution Flow: DLL Side-Loading
Masquerading: Invalid Code Signature
Stage Capabilities: SEO Poisoning
Scheduled Task/Job: Scheduled Task
Dynamic Resolution: Domain Generation Algorithms
Application Layer Protocol: DNS
Process Injection: Process Hollowing
Resource Hijacking
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection
Control ID: SI-3
CISA Zero Trust Maturity Model 2.0 – Application Execution Integrity and Behavioral Analytics
Control ID: Applications & Workloads – Visibility & Analytics
NIS2 Directive – Supply Chain and Software Integrity Security
Control ID: Article 21(2)(e)
PCI DSS 4.0 – Anti-Malware Mechanisms for All System Components
Control ID: Requirement 5.2
DORA (EU 2022/2554) – ICT Threat and Anomaly Detection
Control ID: Article 10 – ICT-related Incident Detection
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: Annex A 8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
IT environments face direct cryptominer deployment risk via trojanized AI desktop apps using DLL sideloading, bypassing signed-binary trust controls and evading egress monitoring through DNS-over-HTTPS C2 channels.
Financial Services
Financial sector workstations running AI productivity tools are high-value cryptominer targets; XMRig injection into svchost.exe undermines PCI 4.0 and NIST.800-53.SC-7 lateral movement controls and exfiltration defenses.
Computer Software/Engineering
Software engineering teams using GitHub-hosted AI tooling are primary victims; SEO-poisoned fake ChatGPT and Claude repositories exploit developer trust, enabling YobaLoader persistence via scheduled tasks and sideloaded DLLs.
Computer/Network Security
Security operations are challenged by DoH-based C2 and signed-executable abuse evading IPS signature detection; validated egress policy enforcement and multicloud visibility controls are critical mitigations per NIST.CSF.PR.DS-5.
Sources
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Minershttps://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.htmlVerified
- Tricks from the Past Deployed via Signed ChatGPT and Claude Binarieshttps://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/Verified
- XMRig: Open-Source Monero CPU Minerhttps://github.com/xmrig/xmrigVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- MITRE ATT&CK: DLL Side-Loading (T1574.002)https://attack.mitre.org/techniques/T1574/002/Verified
- MITRE ATT&CK: Resource Hijacking (T1496)https://attack.mitre.org/techniques/T1496/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
The Yoba campaign relied on unconstrained outbound connectivity and permissive east-west process communication to sustain C2 resolution, cryptomining beacons, and sideloaded payload execution across host processes. Aviatrix Zero Trust CNSF would likely reduce attacker reach by enforcing workload-level segmentation and controlled egress policies that constrain the outbound and lateral paths this campaign depended on.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload-aware fabric policies could likely reduce the reachability of endpoints downloading unvetted external archives by constraining which workloads are permitted to initiate outbound connections to arbitrary external hosting infrastructure like GitHub.io distribution points.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies could likely constrain the lateral process scope available to newly spawned scheduled task execution by reducing the network paths accessible from workloads running persistence mechanisms, limiting how far the foothold could reach across the environment.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the scope of reachable network destinations available to injected processes running inside svchost.exe, constraining how far attacker-controlled code could attempt to traverse toward adjacent workloads, shares, or internal services.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility and policy control would likely reduce the attacker's ability to sustain undetected C2 communications by surfacing anomalous outbound HTTPS and DoH query patterns from workloads that have no legitimate reason to contact Telegram infrastructure or dynamically generated dedyn.io subdomains.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies enforcing controlled outbound access could likely reduce the reachability of injected processes attempting to beacon toward external mining pool infrastructure, constraining the outbound paths available to svchost.exe-hosted miner communications that have no legitimate business justification.
If prior segmentation and egress controls had constrained C2 resolution and mining pool beaconing, the attacker's ability to receive updated work assignments and exfiltrate mined value would likely be significantly reduced, limiting the campaign's financial yield even where host-level execution had already taken place.
Impact at a Glance
Affected Business Functions
- End-User Workstation Availability and Performance
- Corporate IT Infrastructure and Endpoint Security
- Cloud and SaaS Productivity Tooling
- Security Operations and Incident Response
Estimated downtime: 3 days
Estimated loss: N/A
No direct sensitive data exfiltration was confirmed. The primary impact is unauthorized use of victim compute resources for Monero cryptocurrency mining via XMRig injected into svchost.exe. Affected systems experience degraded CPU performance, elevated energy consumption, and potential hardware wear. Victims who downloaded and executed the trojanized AI desktop applications (GPT-5.6 Sol, GPT-6 Astra, Claude Opus fakes) are exposed to persistent scheduled task-based execution, which continues resource hijacking until remediated. No credentials, PII, financial data, or proprietary intellectual property were confirmed as exfiltrated in this campaign. The financial loss estimate reflects unknown aggregate mining revenue extracted from victims; direct remediation and incident response costs for individual organizations are likely modest but non-zero.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (CNSF) with FQDN filtering and outbound traffic controls to block connections to known malicious domains (dedyn[.]io DGA patterns, catbox[.]moe payload hosting, and Telegram C2 channels), preventing YobaLoader from reaching its C2 infrastructure and downloading the XMRig stage.
- • Implement Cloud Firewall (ACF) with AI-assisted traffic discovery and URL filtering at the internet egress boundary to identify and block anomalous outbound DNS-over-HTTPS queries to non-corporate DoH resolvers and unusual HTTPS beacon patterns characteristic of DGA-based C2 communications.
- • Enable Multicloud Visibility & Control with centralized traffic observability and anomaly detection to baseline normal process-to-network communication patterns and alert on svchost.exe initiating unexpected outbound connections to cryptocurrency mining pools or unfamiliar external endpoints.
- • Apply Zero Trust Segmentation with least-privilege identity-based policies to restrict which workloads and processes are permitted to initiate outbound internet connections, ensuring that DLL-sideloaded processes executing under ProgramData paths cannot establish arbitrary external network sessions without explicit policy authorization.
- • Leverage Inline IPS (Suricata) with current threat signatures for known XMRig network fingerprints, DGA domain patterns, and malware delivery indicators to detect and block exploit traffic and known-bad payload delivery at the network layer before cryptominer payloads can be fetched from file-hosting platforms like catbox[.]moe.
