---
title: "Yoba Campaign: Hackers Infect PCs with Fake ChatGPT and Claude Installers, Bypassing Windows Protection"
description: "Check Point Research has uncovered the Yoba campaign, where hackers distribute fake ChatGPT and Claude installers via GitHub and Google, leveraging legitimate digital signatures and the hidden XMRig cryptominer controlled via Telegram."
date: 2026-10-30T10:18:42.740Z
lang: en
url: https://xab.info/en/posts/yoba-campaign-fake-chatgpt-claude-installers
tags: [cybersecurity, chatgpt, claude, github, malware, crypto-miner, check-point, dll-sideloading]
author: "Alexander Buran, Roman V."
publisher: "XAB.info"
---

# Yoba Campaign: Hackers Infect PCs with Fake ChatGPT and Claude Installers, Bypassing Windows Protection

![Laptop displaying GitHub browser and fake ChatGPT and Claude installers on screen](https://xab.info/media/2026/10/30/yoba-kampaniya-feykovi-ustanovshchiki-chatgpt-i-claude/yoba-kampaniya-feykovi-ustanovshchiki-chatgpt-i-claude-1.webp)

## Key Points

- The Yoba campaign distributes fake ChatGPT and Claude desktop apps via GitHub repositories and SEO-poisoned Google search results
- The malware uses a genuine signed Setup.exe from OpenAI/Anthropic combined with a malicious winmm.dll to bypass Windows security
- Once installed, it deploys the XMRig cryptominer over Tor, managed through Telegram channels and encrypted DNS queries
- The malware deliberately avoids systems with CIS keyboard layouts, except for Ukraine
- Experts recommend downloading AI apps exclusively from official sources and avoiding suspicious ZIP archives

Cybersecurity experts from Check Point Research have uncovered a large-scale malicious campaign named Yoba, in which attackers distribute fake desktop applications for ChatGPT and Claude via GitHub and Google search ads. This was reported by RBC-Ukraine citing a fresh analytical report from the company's research division. The campaign is a complex attack combining SEO manipulation, social engineering, and vulnerabilities in Windows trust mechanisms, making it particularly dangerous for ordinary users without deep information security knowledge.

### SEO Poisoning and Fake Repositories as an Entry Point

The first stage of the attack is built on a classic yet extremely effective technique known as search engine poisoning. Attackers create GitHub repositories and web pages with titles mimicking current versions of popular AI services — for instance, "GPT-5.6 Sol" or "Claude Opus". Thanks to search engine optimization, these fraudulent resources rank at the top of Google search results, looking like fully legitimate findings to the user. A person searching for a desktop version of ChatGPT or Claude sees what appears to be a flawless page complete with descriptions, screenshots, and a download button, unaware that it is a trap. An additional distribution channel is Google's paid advertising, where fake links compete directly with official developer resources.

### Legitimate Signatures and DLL Sideloading: How Windows Trust Is Bypassed

A key element of the Yoba campaign is the use of a genuine digital installer. The downloaded ZIP archive contains a real Setup.exe file signed with a valid OpenAI or Anthropic certificate. It is this signature that tricks Windows into considering the installer safe and preventing standard security alerts from triggering, as the file is formally legitimate. However, alongside the authentic Setup.exe, the archive includes a malicious dynamic library named winmm.dll. The DLL sideloading mechanism allows this library to load automatically during installation: trusting the signed executable, Windows fails to inspect the contents of accompanying DLL files. Consequently, the malicious code executes within the context of a trusted process, bypassing most heuristic and signature-based detectors.

### Hidden Cryptominer and Telegram Command-and-Control

Upon successful loading, the malicious library installs the XMRig cryptominer on the target system—a popular tool for mining Monero. Mining is conducted over the Tor network, complicating traffic tracing and masking the actual pool address. To minimize detection risks, the attackers implemented adaptive behavior: the miner automatically pauses when the user actively interacts with the computer (keystrokes, mouse movement) and resumes mining during idle periods. The command-and-control architecture operates on two levels: primary instructions are received via Telegram channels, while backup and encrypted communications are handled through DNS queries. This architecture allows the campaign operators to remotely update configurations, change mining pools, and disable infection on specific machines.

### Geographic Selection: Who Is at Risk

An analysis of the malware's behavioral characteristics revealed an interesting detail: the program deliberately avoids infecting computers configured with CIS keyboard layouts, with the sole exception of Ukraine. This indicates that the operators either intentionally exclude a portion of the Russian-speaking audience from the victim pool (perhaps to reduce the likelihood of detection in the Russian-language internet segment) or use the keyboard layout as a proxy indicator for the region. Meanwhile, users from Ukraine, according to the report, are not protected by this filter and remain at risk alongside everyone else. Check Point Research does not disclose the exact motives behind this selection in its public report.

### Expert Recommendations: How to Protect Yourself

Check Point Research specialists provide several practical recommendations. First, official AI service applications should only be downloaded from trusted sources — such as claude.com/download for Claude or the official Microsoft Store. Second, if a user has already downloaded a suspicious ZIP archive from GitHub, they are strongly advised not to open or run its contents. If the installer was launched accidentally, experts recommend immediately disconnecting the device from the network, running a full antivirus scan, and checking for suspicious processes (specifically XMRig) and startup entries. Given that the malware utilizes legitimate digital signatures, standard antivirus checks may fail to spot the threat; therefore, an additional step involves manually inspecting the unpacked archive's contents and cross-referencing file hash sums with official values published by the developers.

## Fact-Check & Sources

- [Фейковые ChatGPT и Claude заражают ПК: как мошенники обходят защиту Windows](https://www.rbc.ua/ukr/news/feykovi-chatgpt-i-claude-zarazhayut-pk-k-1793352335.html) - The primary source provides a full technical analysis of the Yoba campaign: SEO poisoning mechanism, DLL sideloading via winmm.dll, XMRig cryptominer over Tor, C2 via Telegram, and geographic selection based on layouts. All facts in the article have been verified against the source text.

## FAQ

### What is the Yoba campaign?

Yoba is a malicious campaign where hackers distribute fake desktop installers for ChatGPT and Claude via GitHub and Google search results. The goal is to infect user computers with the hidden XMRig cryptominer.

### Why doesn't standard Windows protection block the fake installer?

The ZIP archive contains a genuine Setup.exe file signed with a valid digital certificate from OpenAI or Anthropic. Windows trusts the signed file and does not block it. The malicious winmm.dll library loads automatically during installation via the DLL sideloading mechanism.

### How does the malware conceal the mining activity?

The XMRig cryptominer operates over the Tor network and automatically pauses mining when the user is actively interacting with the computer (keystrokes, mouse movement). Control commands are delivered via Telegram channels and encrypted DNS queries.

### Who is at risk?

All users downloading desktop versions of AI services from Google search results or GitHub. The malware deliberately avoids systems with CIS keyboard layouts, except for Ukraine, meaning users from Ukraine are not protected by this filter.

### What should I do if I have already downloaded a suspicious archive?

Do not open or run the archive's contents. If the installer was accidentally launched, immediately disconnect the device from the network, run a full antivirus scan, and check for the XMRig process and startup entries. Official applications should only be downloaded from verified sources: claude.com/download or the Microsoft Store.