Check Point has documented Yoba, a fake ChatGPT desktop malware campaign that ships genuine OpenAI and Anthropic signed executables from GitHub alongside a malicious winmm.dll. For Cyprus and EU firms, the signature that staff and some allow-lists trust covers only the honest file in the ZIP.
Key takeaways
- Yoba pairs genuine OpenAI or Anthropic signed executables with a malicious winmm.dll in ZIPs on GitHub releases, promoted through search.
- No vendor was breached, so there is nothing to patch; install policy is the fix.
- YobaDropper exits without administrator rights, so removing local admin is the cheapest control.
- In triage, look past the signed EXE: an unsigned DLL loaded from the same user folder is the tell.
Why can a signed ChatGPT download still be malware?
A valid signature proves who built one file. It says nothing about the other files in the folder. Yoba, a campaign documented by Check Point Research and reported by HackRead in November 2026, is built on that gap.
The attackers published GitHub project pages, some on GitHub.io, advertising desktop builds called “GPT-5.6 Sol”, “GPT-6 Astra” and “Claude Opus”. Each links to a ZIP on GitHub releases holding a real ChatGPT or Claude executable signed by OpenAI or Anthropic, plus a file named winmm.dll.
When the signed program starts, it loads winmm.dll from its own folder, a technique known as DLL sideloading. The signature still verifies while the attacker’s code runs. Neither vendor was compromised, so there is no flaw to patch.
Search did the distribution. Some pages ranked among the top Google results, and Check Point judged the wording and visibility to be deliberate search-engine optimization, with no inflated stars or forks. Our report on the fake ChatGPT Plus 5.6 campaign showed the same brand bait arriving by a different route.
What does Yoba do once someone approves the installer?
YobaDropper checks its environment first. Without administrator rights it asks for elevation and exits, so a user without local admin stops the chain. It also skips machines with Russian or Belarusian keyboard layouts; Ukrainian stays eligible. Check Point notes keyboard settings do not reliably reveal location, and the reporting names no actor.
- Persistence: a scheduled task launches a copied Windows executable three minutes after startup, which loads YobaLoader, so the infection survives a restart.
- Moving address: YobaLoader builds a domain name from the last 50 bytes of a Telegram channel’s profile image. Swap the image and the destination changes, so static blocklists go stale fast.
- Hidden tasking: the loader pulls an encrypted DNS TXT record through Google’s DNS-over-HTTPS service, then fetches an encrypted payload, hosted on Catbox in the chain Check Point examined. Those lookups look like ordinary HTTPS to Google and will not appear in your DNS logs unless you enforce an internal resolver or inspect TLS.
The payload Check Point observed was XMRig over Tor, able to pause while someone uses the PC. YobaLoader also accepts executable and PowerShell payloads. On a broker’s dealing PC or an EMI payments desk, that admin-level foothold reaches Outlook, live SSO sessions and saved passwords, and theft takes one new set of instructions.
What should IT do if someone ran the fake ChatGPT desktop malware?
Treat the host as compromised and isolate it. Deleting the app folder leaves the scheduled task and loader in place.
- Preserve the ZIP and extracted folder for forensics.
- Look for tasks registered around the install date (Security event 4698 with object auditing, or event 106 in the TaskScheduler Operational log) with an At startup trigger launching an executable from a user-writable path.
- Query Sysmon Event ID 7 for winmm.dll loaded from Downloads, AppData or other user folders.
- Flag non-browser processes reaching Google’s DoH endpoint, and any Tor traffic from workstations.
- Revoke SSO sessions, rotate credentials used on the host, and check NIS2 or DORA reporting thresholds.
Take indicators from Check Point Research’s Yoba write-up. Still unknown: when the campaign began, how many machines are infected, and whether any victim got more than the miner.
In our engagements, triage often stops at the signed EXE. Look at the DLL beside it. An assumed breach assessment tests whether your EDR flags an unsigned DLL loaded by a signed vendor binary.
Which install rules stop the next unofficial AI app?
Yoba needs a user with admin rights and an install from an untrusted source. Remove either and the chain breaks.
- Allow AI desktop clients only from the vendor’s site or an internal software catalog; treat GitHub releases as untrusted.
- Remove local admin from users who do not need it.
- Audit application-control and EDR exceptions that trust any OpenAI or Anthropic signed binary wherever it runs. Tie trust to the official install path and alert on unsigned DLL loads.
- Block or log DoH to public resolvers from managed endpoints.
An AI supply chain security audit builds the inventory these rules depend on: which AI clients and plugins staff run, and where each came from.
FAQ
Can a signed ChatGPT executable still be malware?
The signed file is genuine, but it can load a malicious DLL placed in the same folder. The signature vouches for one executable, not the package.
Were OpenAI or Anthropic hacked?
No. The attackers bundled copied legitimate binaries with their own DLL; apps downloaded directly from the vendors are not affected.
What should a Cyprus company do if an employee installed a ChatGPT app from GitHub?
Isolate the machine, preserve the package, hunt for the scheduled task and sideloaded DLL, and revoke sessions and credentials. Then check NIS2 or DORA reporting thresholds.
If you want to know whether a signed binary loading an unsigned DLL would raise an alert on your workstations, our NIS2 penetration testing covers endpoint controls as well as the perimeter.