Tahdid aktorlari Anthropic Claude va OpenAI ChatGPT sun'iy intellekt (AI) ish stoli ilovalari niqobi ostida zararli yuklovchilar va kriptovalyuta minerlarini tarqatmoqda. Bu faoliyat Yoba deb nomlangan kampaniya doirasida amalga oshirilmoqda.
Faoliyat GPT-5.6 Sol, GPT-6 Astra va Claude Opus kabi ish stoli ilovalari deb da'vo qiladigan soxta GitHub loyihalarini yaratishni o'z ichiga oladi, ammo aslida ular YobaLoader deb nomlangan zararli dastur oilasini yetkazib beradi.
"Zararli dastur OpenAI va Anthropic'dan olingan haqiqiy, imzolangan bajariladigan fayllar yoniga joylashtirilgan, shuning uchun u bilvosita yuklanishi mumkin. Bu usul DLL sideloading deb ataladi va ko'pincha xavfsizlik himoyalarini chetlab o'tish uchun ishlatiladi," deb aytgan Check Point Research o'z tahlilida.
Loyihaning ishonchliligini oshirish uchun hujumchilar dasturiy ta'minot imkoniyatlarini tasvirlash uchun GitHub.io sahifalarini ham tashkil etgan. GitHub loyihalarining mashhurligi ghost tarmoqlar kabi usullar bilan sun'iy ravishda oshirilmagan bo'lsa-da, SEO zaharlash (poisoning) usullaridan foydalanilganligi belgilari mavjud. Bu usullar Google qidiruv natijalarida ushbu havolalarning yuqori o'rinlarda paydo bo'lishini ta'minlaydi.
Aniqlangan GitHub sahifalari havolalari quyidagilar:
- github[.]com/gpt-5-6/sol-free-desktop
- gpt-5-6.github[.]io
- github[.]com/gpt-5-6/gpt-5-6.github.io
- github[.]com/gpt-6-astra/gpt-6-astra.github.io
- gpt-6-astra[.]github[.]io
- github[.]com/opus-5-0/opus-5-0.github[.]io
- opus-5-0[.]github[.]io
"Har bir ombor turli elektron pochta manzillaridan foydalanadi (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com va rioprestonlfyx[@]outlook[.]com), yuklovchi esa mos ravishda UTC+4, UTC-4 va UTC+3 vaqt zonalarida ishlayotganga o'xshaydi," deb aytgan Check Point. "Bu nomuvofiqlik tahdid aktorining haqiqiy operatsion vaqt zonasini yashirishga qaratilgan ataylab qilingan urinishni aks ettiradi."
Ushbu omborlarda joylashtirilgan ZIP arxivlari boshqa fayllar bilan birga ikkita maxsus komponentni o'z ichiga oladi:
- Setup.exe — haqiqiy, imzolangan OpenAI Codex yoki Claude bajariladigan fayli
- winmm.dll — bajariladigan fayl tomonidan bilvosita yuklanadigan zararli DLL
DLL — YobaDropper deb nomlangan yuklovchi bo'lib, u o'z mezbon bajariladigan faylining bazaviy nomini xeshlash orqali tekshiruv qiymatlarini amalga oshiradi. Agar u qattiq kodlangan "0xE6C2F326" qiymatiga mos kelsa, tekshiruv muvaffaqiyatli bo'ladi. Boshqacha aytganda, tekshiruv DLL faqat "Setup.exe" ostida ishga tushirilishini talab qiladi va agar DLL o'z-o'zidan sandbox muhitida bajarilsa, muvaffaqiyatsiz tugaydi.
Qo'shimcha anti-tahlil usullari va oldindan tekshiruvlar 200 000 marta "Sleep(5500)" takrorlanishini o'z ichiga oladi, bu 12,73 kunga teng, shuningdek, klaviatura tartibi Rossiya, Belarus, Tojikiston, Armaniston, Ozarbayjon, Gruziya, Qozog'iston, Qirg'iziston, Turkmaniston va O'zbekistonga mos keladigan mashinalarni chetlab o'tadi.
Infeksiya jarayonidan chiqarib tashlangan yana bir til identifikatori — tatar tili. E'tiborga molik jihati shundaki, tarixan bunday tekshiruvlarga kiritilgan Ukraina bu ro'yxatda yo'q.
YobaDropper o'z navbatida "wmpdmc.exe" va "ampdui.dll" dan iborat o'z DLL sideloading zanjirini ishga tushiradi. U birinchisini "system32" jildidan nusxalab, "ProgramData" ostida yaratilgan "WMProcess" deb nomlangan yangi katalogga joylashtiradi.
So'ngra yuklovchi o'rnatilgan yukni ajratib, shifrlaydi va uni "wmpdui.dll" bilan bir xil jildga tushiradi. Shuningdek, u rejalashtirilgan vazifa (scheduled task) orqali doimiylikni ta'minlaydi, bu vazifa haqiqiy bajariladigan faylni ishga tushirib, zararli yukni yuklaydi.
Ikkinchi DLL — YobaLoader. U YobaDropper bilan bir xil anti-sandbox usulini amalga oshiradi va zararli dastur faqat "wmpdmc.exe" tomonidan ishga tushirilishini talab qiladi. Buning uchun xeshni qattiq kodlangan "0x552751E3" qiymati bilan tekshiradi. Yuklovchi uchta asosiy vazifani bajaradi:
- Telegram kanalidan ("t[.]me/yoba_fanclub") rasm yuklab oladi.
- Oxirgi 50 baytni urug' (seed) sifatida ishlatib, uchta lug'at so'zlari ro'yxati va 0–999 oralig'idagi butun son yordamida domen generatsiya algoritmi (DGA) orqali domen hosil qiladi. Natijada "adjective-noun-verb-digit.dedyn[.]io" formatidagi domen hosil bo'ladi.
- Google'ning DNS-over-HTTPS (DoH) API'sidan foydalanib, tuzilgan domenni kiritish orqali DNS TXT yozuvidan Base64-kodlangan buyruqni oladi.
- Javobni shifrlab, keyingi bosqich yukini ("files.catbox[.]moe/z5zpy9.dat") olish uchun havolani oladi.
"DoH xizmati va keng tarqalgan fayl-xosting platformalaridan foydalanish orqali aktor passiv DNS monitoringini va ba'zi shlyuzga asoslangan xavfsizlik himoyalarini chetlab o'tishni maqsad qiladi, bu esa ularning buyruq-va-nazorat (C2) trafikini oddiy foydalanuvchi faoliyatidan ajratishni qiyinlashtiradi," deb aytgan Check Point.
Yuklab olingan yuk so'ngra "svchost.exe" jarayoniga in'ektsiya qilinadi, natijada XMRig kriptovalyuta mineri ishga tushadi.
Dalillar shuni ko'rsatadiki, birinchi GitHub ombori 2026-yil iyul atrofida yaratilgan, ammo zararli relizlar avgust oxirigacha yuklanmagan. Bundan tashqari, YobaLoader'ning erta versiyalari faqat Rossiyani infeksiyadan chiqarib tashlagan, shuningdek, keng qamrovli anti-debugging va anti-VM tekshiruvlarini o'z ichiga olgan, keyinchalik yangi versiyalarda bu tekshiruvlar olib tashlangan.
"Yoba kampaniyasi hujumchilar ishonchli platformalar va AI vositalariga bo'lgan hozirgi qiziqishdan foydalanib, zararli dasturlarni bir qarashda ishonchli va zararsiz ko'rinadigan tarzda tarqatishi mumkinligini ko'rsatadi," deb aytgan Check Point. "O'z kodlarini taniqli dasturiy ta'minot nomlari bilan birga joylashtirib va uni GitHub'da joylashtirib, ular foydalanuvchilar yoki asosiy xavfsizlik tekshiruvlari fayllarni darhol shubhali deb belgilash ehtimolini kamaytiradi."
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.
The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader.
"The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections," Check Point Research said in an analysis.
To add to the project's credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects' popularity is not manipulated using techniques like ghost networks, signs point to the use of SEO poisoning tactics to ensure that links to them are surfaced on top of search results on Google.
Some of the identified GitHub pages links are below -
- github[.]com/gpt-5-6/sol-free-desktop
- gpt-5-6.github[.]io
- github[.]com/gpt-5-6/gpt-5-6.github.io
- github[.]com/gpt-6-astra/gpt-6-astra.github.io
- gpt-6-astra[.]github[.]io
- github[.]com/opus-5-0/opus-5-0.github[.]io
- opus-5-0[.]github[.]io
"Each repository uses a different email address (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com), and the uploader appears to operate in UTC+4, UTC-4, and UTC+3 respectively," Check Point said. "This inconsistency likely reflects a deliberate attempt to obscure the threat actor's true operational time zone."
Hosted within these repositories are ZIP archives that, among other files, contain two specific components -
- Setup.exe, a legitimate signed OpenAI Codex or Claude executable
- winmm.dll, a malicious DLL that's sideloaded by the executable
The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value "0xE6C2F326." In other words, the check requires it to be launched under "Setup.exe," and fails if the DLL is executed on its own inside a sandboxed environment.
Additional anti-analysis techniques and pre-checks include 200,000 iterations of "Sleep(5500)," which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan.
Another language ID excluded from the infection process is Tatar. Notably missing from the list is Ukraine, which used to be historically included in such checks.
YobaDropper, for its part, triggers a DLL sideloading chain of its own comprising "wmpdmc.exe" and "ampdui.dll," copying the former from its "system32" folder and placing it in a new directory named "WMProcess" created under "ProgramData."
The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as "wmpdui.dll." It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.
The second DLL is YobaLoader. It implements the same anti-sandbox technique as YobaDropper, requiring the malware to be run only by "wmpdmc.exe" by checking the hash against a hard-coded value ("0x552751E3"). The loader is responsible for three main tasks -
- Downloads an image from a Telegram channel ("t[.]me/yoba_fanclub").
- Uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words and an integer value in the range 0–999 using a domain generation algorithm (DGA). The end result is domain in the format "adjective-noun-verb-digit.dedyn[.]io."
- Queries Google's DNS-over-HTTPS (DoH) API to obtain a Base64-encoded command from a DNS TXT record by passing the constructed domain as input.
- Decrypts the response to obtain the link to fetch the next-stage payload ("files.catbox[.]moe/z5zpy9.dat").
"By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity," Check Point said.
The downloaded payload is then injected into "svchost.exe," resulting in the execution of an XMRig cryptocurrency miner.
Evidence indicates that the first GitHub repository was created around July 2026, although the malicious releases were not uploaded until the end of August. What's more, early versions of YobaLoader have been found to only exclude Russia from infection, while also incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.
"The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance," Check Point said. "By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.