Check Point tracks a two-month campaign it calls Yoba. Fake GitHub projects and GitHub Pages sites, pushed up Google results by SEO poisoning, offer desktop apps for GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The ZIP releases contain a genuine signed OpenAI or Anthropic Setup.exe plus a malicious winmm.dll it loads. An earlier June variant expected to be loaded by Cursor.exe. The final payload seen so far is an XMRig miner, but the loader will run any program or PowerShell script it is sent.

1. Delivery: ZIPs named sol-setup.zip, Setup-Claude.zip and GPT-6-Astra-Setup.zip from repos such as gpt-5-6/gpt-5-6.github.io, opus-5-0/opus-5-0.github.io and gpt-6-astra/gpt-6-astra.github.io. Hunt for winmm.dll loaded from a user folder by a signed Setup.exe rather than from System32. The DLL refuses to run unless started by Setup.exe, and stops with "Please run this program as Administrator." without admin rights.
2. Persistence: a folder C:\ProgramData\WMProcess\ holding a copy of WMPDMC.exe and a malicious wmpdui.dll, plus a scheduled task running as SYSTEM, 3 minutes after boot, with author "Microsoft Corporation" and the description "Collects device metadata for Windows Media Player.". WMPDMC.exe should never run from ProgramData.
3. Command and control: the loader reads the profile photo of Telegram channel t[.]me/yoba_fanclub, turns it into a domain like adjective-noun-verb-123.dedyn[.]io, then asks dns[.]google/resolve for that name's TXT record. Alert on non-browser processes calling Google DoH, and on any *.dedyn.io TXT lookups. Payloads came from files.catbox[.]moe.
4. Payload: XMRig 6.26.0 injected into svchost.exe, mining through a bundled Tor client (data in %TEMP%\torbundle\data, local SOCKS port 9550, mutex Local\WindowsSecurity), pausing while the user is active. It may also load the WinRing0 driver. Other runs drop a random-named EXE or PS1 in a random %TEMP% folder and strip its Zone.Identifier.

Check Point says the malware skips machines with keyboard layouts from several CIS countries and that the operator shows signs of Russian origin. Its report has the full DGA word lists, Tor bridges and the Ed25519 key used to sign tasks.