Related Families: YobaLoader, YobaDropper, XMRig
Executive Summary
A malware campaign tracked as Yoba uses fraudulent GitHub projects impersonating ChatGPT and Claude applications to distribute malicious installers. The campaign combines DLL sideloading through legitimate, digitally signed executables with anti-analysis techniques and a multistage loader that uses Telegram, DNS over HTTPS, and public hosting services to retrieve additional payloads. Although researchers observed the deployment of an XMRig cryptocurrency miner, the loader supports additional Windows portable executable (PE) and PowerShell payloads, creating opportunities for attackers to expand the campaign beyond cryptojacking.
