Check Point Research has documented a campaign it calls Yoba that markets nonexistent AI desktop apps: GPT-5.6 Sol, GPT-6 Astra and a Claude Opus build, all backed by real GitHub repositories and convincing product pages.
The installers work because the executables inside them are genuine. Attackers bundle signed binaries from OpenAI and Anthropic, then plant a malicious DLL beside them. When the real program loads, it picks up the impostor library instead, a sideloading trick that survives a signature check.
The projects did not pad their star counts or fabricate fork histories. They ranked near the top of Google results anyway, which Check Point attributes to SEO poisoning aimed at people searching for the next model release.
Miners now, loaders later
XMRig, a Monero miner, is the payload seen in this wave. Commit data places the malicious releases on 30 and 31 August and 4 September. Researchers warn the loader can pull other executables or PowerShell scripts, so cryptomining is a floor rather than a ceiling.
The infrastructure mix is what makes it durable. GitHub Pages hosts the marketing site, GitHub Releases serves the ZIP, and the repository gives the whole thing a legitimacy signal that a throwaway domain cannot match.
Closing the gap for users
Signed downloads are your control. Obtain AI desktop clients only from the vendor’s own site or an official package channel, and treat a GitHub release archive as unverified no matter how polished the repository looks. You can verify a signature.
Block execution from user-writable directories, alert on signed AI executables loading DLLs from unexpected paths, and watch for XMRig process names and sustained GPU load on endpoints that should never mine.
