---
title: Hunt: fake "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus" desktop apps on GitHub sideload a malicious winmm.dll next to real signed OpenAI and Anthropic installers, then pull tasks over Google DNS-over-HTTPS | ctxsec
url: https://ctxsec.com/items/hunt-yoba-fake-chatgpt-claude-desktop-signed-setup-sideload
description: ""
status: "threat research (Check Point Research, Oct 27)"
published: 2026-10-27
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-yoba-fake-chatgpt-claude-desktop-signed-setup-sideload.md)

threat research (Check Point Research, Oct 27)

2026-10-27

### Hunt: fake "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus" desktop apps on GitHub sideload a malicious winmm.dll next to real signed OpenAI and Anthropic installers, then pull tasks over Google DNS-over-HTTPS

Check Point tracks a two-month campaign it calls **Yoba**. Fake GitHub projects and GitHub Pages sites, pushed up Google results by SEO poisoning, offer desktop apps for GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The ZIP releases contain a **genuine signed OpenAI or Anthropic Setup.exe** plus a malicious `winmm.dll` it loads. An earlier June variant expected to be loaded by `Cursor.exe`. The final payload seen so far is an XMRig miner, but the loader will run any program or PowerShell script it is sent.

1. **Delivery:** ZIPs named `sol-setup.zip`, `Setup-Claude.zip` and `GPT-6-Astra-Setup.zip` from repos such as `gpt-5-6/gpt-5-6.github.io`, `opus-5-0/opus-5-0.github.io` and `gpt-6-astra/gpt-6-astra.github.io`. Hunt for `winmm.dll` loaded from a user folder by a signed Setup.exe rather than from System32. The DLL refuses to run unless started by Setup.exe, and stops with "Please run this program as Administrator." without admin rights.
2. **Persistence:** a folder `C:\ProgramData\WMProcess\` holding a copy of `WMPDMC.exe` and a malicious `wmpdui.dll`, plus a scheduled task running as SYSTEM, 3 minutes after boot, with author "Microsoft Corporation" and the description "Collects device metadata for Windows Media Player.". WMPDMC.exe should never run from ProgramData.
3. **Command and control:** the loader reads the profile photo of Telegram channel `t[.]me/yoba_fanclub`, turns it into a domain like `adjective-noun-verb-123.dedyn[.]io`, then asks `dns[.]google/resolve` for that name's TXT record. Alert on non-browser processes calling Google DoH, and on any `*.dedyn.io` TXT lookups. Payloads came from `files.catbox[.]moe`.
4. **Payload:** XMRig 6.26.0 injected into `svchost.exe`, mining through a bundled Tor client (data in `%TEMP%\torbundle\data`, local SOCKS port 9550, mutex `Local\WindowsSecurity`), pausing while the user is active. It may also load the WinRing0 driver. Other runs drop a random-named EXE or PS1 in a random `%TEMP%` folder and strip its Zone.Identifier.

Check Point says the malware skips machines with keyboard layouts from several CIS countries and that the operator shows signs of Russian origin. Its report has the full DGA word lists, Tor bridges and the Ed25519 key used to sign tasks.

Sources: [Check Point Research: Tricks from the Past deployed via signed ChatGPT and Claude binaries (Oct 27)](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/)