Signed AI Binaries Are Not Safe: Yoba Malware Exploits ChatGPT and Claude App Lures
What happened
Check Point Research published findings on the Yoba campaign, which distributes an XMRig cryptominer by packaging malicious code alongside legitimate, digitally signed OpenAI and Anthropic binaries. The technique, known as DLL sideloading, works by placing a malicious file next to a trusted program so the trusted program loads it automatically at startup. Because the main executable carries a genuine vendor signature, standard software trust checks pass without flagging anything. Fake installers are distributed through GitHub repositories and GitHub Pages sites. These sites rank highly in search results through SEO poisoning. This exploits employees searching outside approved channels for AI productivity tools. Once installed, the miner hides its communications inside traffic to legitimate services including Telegram and Google, making it harder for network monitoring tools to detect. The AI Tool Lures Drive 67% of Browser-Based Attacks, Exposing Shadow AI Controls story documented a closely related threat pattern earlier this year.
Why it matters
- ·Signature verification is insufficient as a standalone control. The Yoba campaign shows a validly signed binary can be bundled with malicious code. Allowlisting policies that rely only on vendor signatures will not catch these attacks. Enterprises need controls that verify the integrity of the full software package, not just the main executable.
- ·Shadow IT procurement is the entry point: victims reach fake AI apps because they are searching outside approved software channels. Organizations without a clear sanctioned-AI-tool list and a process to handle employee requests for new AI software are structurally exposed to this class of attack.
- ·Incident detection is complicated by traffic hiding: the campaign routes its command-and-control communications through legitimate services, making it harder for network security teams to identify compromised machines. This extends the window between infection and detection, raising the cost of each incident.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit your approved-AI-software list and confirm it is published and accessible to all employees, so staff have a clear alternative to searching for tools independently.
- ☐Ask your IT or endpoint security team whether your software controls check the integrity of full installation packages, not just the digital signature on the main executable file.
- ☐Review your onboarding and acceptable-use training to confirm it explicitly addresses the risk of downloading AI tools from search results, GitHub, or unofficial sites.
- ☐Run a sweep of endpoints for unauthorized AI desktop applications, including any ChatGPT, Claude, or other AI tool installers not deployed through your official software distribution channel.
- ☐Confirm with your security operations team that network monitoring covers traffic routed through services such as Telegram and cloud DNS providers, which attackers are using to hide malicious communications.
What to watch next
Check Point's documentation of the Yoba campaign follows a broader pattern of attackers using AI tool demand as a lure. Security researchers are likely to document additional variants targeting other AI brand names. Compliance teams should monitor whether GitHub and other code-hosting platforms tighten controls on repositories that impersonate commercial AI products. Also watch for guidance from endpoint and software asset management vendors on detecting DLL sideloading in AI application installers. If your organization is subject to the EU AI Act (Regulation (EU) 2024/1689), regulators may ask whether your AI tool procurement controls extend to endpoint security and employee software sourcing practices.