Based on information from Infosecurity Magazine, attackers are distributing a sophisticated malware chain by impersonating popular artificial intelligence desktop applications on GitHub.
The campaign, identified by Check Point Research as Yoba, utilizes fake projects posing as tools like Claude and various iterations of ChatGPT. These malicious applications leverage search engine optimization poisoning to appear in top search results. The attackers bundle legitimate, signed executables from companies like OpenAI with a malicious dynamic link library. This technique, known as DLL sideloading, allows the malware to bypass standard security protections. The YobaDropper component performs environmental checks to avoid systems in specific regions and employs delays to hinder automated analysis. Once established, the malware uses scheduled tasks to maintain persistence. The secondary stage, YobaLoader, communicates via Telegram and Domain Name System-over-HTTPS to fetch further instructions, effectively masking its command-and-control activity. While the current payload is an XMRig cryptominer, researchers warn that the modular nature of the loader could facilitate the delivery of more dangerous threats in future attacks. Organizations are advised to exercise caution when downloading software from unverified repositories and to implement strict controls regarding the execution of unknown binaries to mitigate these evolving risks.
Source: Infosecurity Magazine
