A new cybercrime campaign uses fake AI apps with real-sounding names to infect people who are curious to try the newest tools.
follow us
Add us as a preferred source on Google
- Attackers used SEO-poisoned GitHub pages and fake AI clients to lure victims into downloading malware
- Yoba malware establishes persistence, evades analysis, and ultimately deploys XMRig cryptominers.
- The campaign abuses interest in popular artificial intelligence tools such as GPT and Claude to monetize victims’ computing resources.
Cybercriminals are, once again, exploiting people’s interest in artificial intelligence tools to distribute cryptojackers and make money; this time, opting for a combination of popular counterfeit products, good old GitHub, and a bit of SEO poisoning.
The campaign was detected by security experts at Check Point Research (CPR), who have been tracking it for the past two months, noting that anonymous attackers created fake downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and hosted them on GitHub.
Typically, when threat actors spoof legitimate software and attempt to spread it through GitHub, they go the extra mile to feign legitimacy: artificially inflating download numbers, deploying bots to boost star or fork numbers, and posting fake comments. That way, when a victim opens the page, they have no reason to doubt that they are viewing legitimate and popular software.
Latest videos ofTechnologyRadar
In this case, however, they didn’t bother with GitHub. However, CPR says that the pages still appear at the top of Google’s search engine results pages for certain keywords, indicating that they have invested heavily in SEO poisoning.
SEO Poisoning
Search engine optimization (SEO) poisoning is a simple practice: criminals purchase hundreds (if not thousands) of articles, blogs, and social media posts on the dark web, and upload and publish them on the Internet.
Each post carries a link to the desired GitHub page, giving Google the signal that that specific page is popular and relevant for certain terms.
As a result, Google pushes you to the top of their results, unknowingly helping attackers reach their goals faster. The attackers also created separate GitHub websites to serve as app descriptions and linked them directly to downloadable installation files.
As a practice, SEO poisoning was popular even before the advent of AI, but now it has become even easier, as the tools can easily generate as many articles as needed, for a fraction of the previous cost. Obviously, these texts are of very low quality and Google has been working to label them as spam, but the process is still ongoing.
When victims land on these GitHub pages and download the executables, they believe they are getting a standalone client for an artificial intelligence tool. Instead, what they get is a malware called Yoba.
Once a victim downloads and runs it, Yoba establishes persistence by creating a mechanism that will automatically start it every time the system is rebooted. Average computer users may also have difficulty detecting it as it presents itself as legitimate Windows software.
Yoba then checks the device it’s running on to make sure it’s not in a sandbox or infecting someone in a “friendly” country. It can deliberately delay execution for two weeks to make scanning more difficult and checks the computer keyboard to avoid infecting systems from Russia, Belarus, Kazakhstan and Uzbekistan. CPR did not say where the attackers are from, but this filter could give a strong indication.
XMRig Implementation
The last step of the malware is to contact the C2 server and extract the final payload. While this can be virtually anything from data stealers to ransomware encryptors, CPR says it is currently being used to implement XMRig.
XMRig is a completely legitimate open source program used to mine the Monero cryptocurrency.
Unfortunately, it is extremely popular with cybercriminals because Monero is designed to be a privacy-first currency and, unlike Bitcoin or Ethereum, cannot be traced as easily through the blockchain. Mining requires significant computing and electrical resources, as well as devices being connected to the Internet. By installing XMRig on countless devices, criminals can generate a large amount of tokens, leaving victims to bear the inflated energy and computing bill.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment