Fake AI tools on GitHub distribute malware via signed binaries

SEO-poisoned AI lures

Researchers at Check Point Research have identified a campaign distributing a custom malware chain called Yoba. The attackers are leveraging the high demand for AI tools by creating fake GitHub projects that impersonate popular models. These projects claim to offer desktop applications for models like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.

To reach victims, the attackers use SEO poisoning to ensure these fake projects appear at the top of external search engine results. While the repositories do not have artificially inflated stars or forks to trick GitHub's internal search, they are optimized for external discovery. The projects use GitHub.io pages to describe software capabilities and host malicious ZIP files as releases.

The attackers appear to be intentionally obscuring their location by using different email addresses and operating across multiple timezones. Each repository is linked to a different outlook.com email account. This strategy helps them avoid detection by security researchers who track threat actor patterns based on active hours.

Sideloading signed binaries

The malware package contains a malicious component called YobaDropper. This dropper includes a YobaLoader designed to contact attacker infrastructure and fetch the final payload. To bypass security software, the attackers use legitimate, signed executables from OpenAI and Anthropic to sideload the malicious code.

Specifically, the attackers include a legitimate signed Setup.exe from OpenAI or a Claude executable in the ZIP files. When the user runs the installer, the legitimate program is used to load a malicious DLL. The malware spoofs the name of a common Windows file, winmm.dll, but strips out most of its original code to reduce its size and avoid detection.

The malware also includes anti-sandbox techniques to prevent security researchers from analyzing it in virtual environments. One function hashes the name of the host executable and compares it to a hardcoded value. If the check fails, the malware enters a loop that sleeps for approximately 12.73 days while performing useless operations to exhaust the resources of automated analysis tools.

Persistence and evasion

Once the malware is executed, the dropper creates a directory in ProgramData and copies a legitimate Windows Media Player file into it. It then decrypts and drops a payload named wmpdui.dll. To maintain a presence on the system, it creates a scheduled task that triggers three minutes after the computer starts.

The attackers make this scheduled task look like a standard Windows function by naming the author Microsoft Corporation. They also set the description to suggest the task is collecting metadata for Windows Media Player. This tactic is designed to blend in with legitimate system processes and avoid notice from the average user.

The malware also performs specific checks to determine if the victim is in a target region. It inspects the system's keyboard layout to see if the user is located in a CIS country. Interestingly, it uses a bitmask to check for specific language IDs while explicitly excluding Ukraine from the list of targeted regions.

Dynamic command channels

The YobaLoader uses a sophisticated method to receive instructions from the attackers. It first visits a specific Telegram channel to find the URL of the channel's profile image. It then downloads this image and uses the last 50 bytes of the file as a seed for a domain generation algorithm (DGA).

This DGA combines the image data with lists of adjectives, nouns, and verbs to create a unique domain name ending in .dedyn[.]io. By simply changing the profile picture on their Telegram channel, the attackers can generate new domains for their command-and-control traffic. This makes it very difficult for security teams to block the malware using static blacklists.

To receive commands, the malware queries Google’s DNS-over-HTTPS (DoH) API. This method encrypts the DNS requests, making it harder for network security tools to see where the malware is communicating. The malware then validates the response using an Ed25519 signature before decrypting the final instructions using AES encryption.