Technical breakdown: Yoba 2026's DLL sideloading chain behind fake AI apps
TechNadu · x · 2026-10-28
TechNadu published a technical breakdown of the "Yoba 2026" campaign Check Point exposed: fake ChatGPT and Claude desktop apps spread via SEO poisoning and malicious GitHub repos.
Technical details
- A malicious winmm.dll placed next to legitimately signed Setup.exe binaries enables persistence via DLL sideloading
- The chain abuses Telegram profiles, Google DNS-over-HTTPS, and Catbox to fetch payloads
- XMRig 6.26.0 is ultimately injected into svchost.exe, with traffic routed through a local Tor proxy
A deeper dive on the same event, useful for readers who want the full infection chain.
Related event: Fake ChatGPT and Claude Apps on GitHub Spread XMRig Miner(2 posts)→
More from Safety
- Only Then Labs prototypes re-checking agent approvals when underlying evidence changes — tallmetommy · 2026-10-28
- Sam Altman's World pitches Orb eye-scanning to banks, drawing sci-fi horror comparisons — rschu · 2026-10-28
- Claude Catches North Korean Supply Chain Attack Disguised as an Auth Error — banteg · 2026-10-28
- AMA: Harvard's Stephen Casper on AI safeguards, incidents and governance, Oct 28 — NeuralNomad87 · 2026-10-28
- Detection Isn't Blocking: How to Actually Verify Your AI Agent's Security Guard — shoumikgoswami · 2026-10-28
- Security Asked: Which MCP Servers Are Safe for Enterprise Use, and How Do We Govern Them? — MorePerspectived · 2026-10-28