Overview
- Check Point published a detailed analysis Thursday showing active GitHub projects and GitHub Pages still host ZIP releases that pair legitimate, signed OpenAI or Anthropic executables with malicious DLLs.
- The attackers rely on DLL sideloading, a technique where a genuine signed executable loads a malicious DLL placed beside it, allowing the malware to run while avoiding basic security checks.
- YobaLoader retrieves an image from a Telegram channel, uses part of that image to generate domain names, queries Google DNS‑over‑HTTPS for an encrypted command, and downloads payloads from common file hosts.
- The observed final payload is an XMRig Monero miner injected into svchost.exe and routed through Tor, but the loader can run any executable or PowerShell script so future waves could deliver more damaging malware.
- Because the campaign uses SEO‑poisoned GitHub pages, signed binaries, DoH and public file hosts to evade detection, organizations should block untrusted installs, monitor for DLL sideloading and scheduled tasks, and treat any Yoba detection as a likely wider compromise.