Fake AI apps spread Yoba malware that installs a Monero miner

A cybercrime campaign is using fake downloadable apps for GPT-5.6 Sol, GPT-6 Astra and Claude Opus to distribute malware, according to Check Point Research (CPR). The apps are hosted on GitHub and promoted through search results. CPR says it has tracked the campaign for two months.

The fake apps install Yoba, which can set itself to launch automatically when a computer restarts and presents itself as legitimate Windows software. Yoba checks whether it is running in a sandbox and can delay execution for two weeks, making analysis harder. It also checks the keyboard to avoid infecting systems in Russia, Belarus, Kazakhstan and Uzbekistan. CPR did not identify the attackers’ location.

Yoba contacts a command-and-control server to retrieve its final payload. CPR says the campaign currently uses it to deploy XMRig, a legitimate open-source program for mining Monero. The miner uses victims’ computing power and electricity. The article says CPR did not specify how many devices have been affected.

The campaign’s GitHub pages appear at the top of Google results for some keywords, CPR says. The attackers also use separate GitHub pages linking to installation files. The article describes search engine optimization (SEO) poisoning as a tactic that uses online posts linking to target pages to influence search rankings, and says AI tools have made producing such posts cheaper.