Yoba Campaign Masquerades as AI Chat Apps to Deploy Cryptocurrency Miner

Security researchers have uncovered a new threat‑actor campaign, labeled Yoba, that disguises a cryptocurrency miner as popular artificial‑intelligence chat applications. By presenting the malicious code as legitimate OpenAI ChatGPT and Anthropic Claude executables, the attackers exploit the current hype surrounding generative AI to lure unsuspecting users into installing the software.

The fake binaries are distributed through signed installers that carry valid digital certificates, a tactic that helps them bypass many endpoint protections. Analysts say the packages have been shared on public download portals, file‑sharing services, and even through compromised advertising networks, making the lure appear credible to a broad audience.

Once a victim runs the counterfeit installer, a custom loader is dropped onto the system. The loader contacts remote command‑and‑control servers to retrieve additional payloads, ultimately installing a stealthy cryptocurrency miner that runs silently in the background. Early samples suggest the miner targets privacy‑focused coins such as Monero, which can be mined efficiently on consumer‑grade hardware without drawing immediate attention.

Check Point Research tracked the operation for roughly two months, mapping its infrastructure and noting the use of legitimate code‑signing certificates to legitimize the binaries. The researchers observed that the campaign’s command‑and‑control hosts are hosted on reputable cloud providers, further obscuring the malicious traffic. By piggybacking on the brand recognition of ChatGPT and Claude, the attackers increase the likelihood that users will overlook warning prompts and install the software.

While no major data breaches have been publicly linked to Yoba so far, the potential for rapid spread remains high given the widespread interest in AI tools. Security experts recommend that users download AI applications only from official vendor websites, verify the publisher information in the installer’s digital signature, and keep antivirus and operating‑system patches current. Ongoing monitoring by threat‑intelligence teams will be essential to detect new variants, and analysts warn that the group could shift to other AI‑related binaries or expand the miner’s capabilities as the market evolves.