Yoba’s malware delivery chain uses GitHub pages posing as ChatGPT and Claude desktop downloads, promoted through poisoned search results.
The package pairs a legitimate installer with a malicious DLL; YobaLoader uses DLL sideloading and sandbox checks, while the malware installs XMRig and uses DNS-over-HTTPS to hide its traffic.
It’s a useful case of how download lures and loader techniques combine.
How they seduce you
The perpetrators create fake pages on GitHub, where they showcase supposed AI applications. To get you there, they use techniques that help their pages appear in the top positions of Google. So when someone searches for these popular tools, they are likely to end up on their fake page.
When you download the file, you receive a package that contains a real installation file along with an additional, dangerous file. The program exploits a method to "trick" security systems by appearing legitimate. Once installed, it configures Windows to start automatically every time you turn on your computer.
What's happening to your device?
The software first runs some checks to make sure it's not running in an environment where security experts could detect it. It also appears to avoid computers with keyboard settings from Russia, Belarus, and some neighboring countries.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Bluesky blocks links to the page with the leaked US Department of Homeland Security data
↗
The aim of the attack is to install a hidden program that uses your computer's power to mine digital currencies. This means that your computer is secretly working for the attackers, which can make it noticeably slower and consume more energy. To hide their communication with their own server, they use a method that makes the data traffic look like normal web browsing.
The campaign, which experts are calling Yoba, has been active since the summer of 2026, with malicious files gradually appearing on GitHub since late August. The perpetrators use different emails and change their business hours to make it difficult to track their location.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)