Yoba Malware Campaign: Fake ChatGPT and Claude Installers Sideload Crypto Miners — Detection and Response Guide

---
title: Signed AI Vendor Binary Loading Unsigned DLL From User-Writable Path
id: 3f9c2a71-6b84-4d1e-9a52-7c1e4f8b2d05
status: experimental
description: Detects legitimate signed executables (e.g., ChatGPT/Claude desktop binaries) loading unsigned DLLs from user-writable directories, consistent with Yoba campaign DLL side-loading via trojanized AI client installers.
references:
  - https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\ChatGPT.exe'
      - '\Claude.exe'
      - '\Claude Desktop.exe'
      - '\OpenAI.exe'
  selection_path:
    ImageLoaded|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Temp\'
      - 'C:\Users\Public\'
  selection_unsigned:
    Signed: 'false'
  condition: selection_image and selection_path and selection_unsigned
falsepositives:
  - Beta or self-built AI desktop clients in developer environments
level: high
---
title: Cryptocurrency Miner Command Line Indicators
id: 8d4e1b36-2a57-4f09-b83d-5e6a9c1d7f42
status: experimental
description: Detects process command lines containing XMRig-style mining arguments and Stratum protocol references associated with crypto miners deployed by campaigns such as Yoba.
references:
  - https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - '--donate-level'
      - '--coin='
      - '--algo=rx/'
      - 'xmrig'
      - '--randomx-'
      - 'pool.minexmr'
      - 'supportxmr.com'
  condition: selection
falsepositives:
  - Authorized mining activity in research environments (extremely rare in enterprise)
level: critical
---
title: Outbound Connection to Common Mining Pool Port From Non-Browser Process
id: 5b7f3d92-1c68-4e2a-a94b-3d8f6e0a2c17
status: experimental
description: Detects outbound connections to well-known Stratum mining pool ports by processes other than browsers or known update services, a behavioral indicator of crypto miner deployment seen in the Yoba campaign.
references:
  - https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1496
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 3333
      - 4444
      - 5555
      - 7777
      - 14444
      - 45700
  selection_initiated:
    Initiated: 'true'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\iexplore.exe'
  condition: selection_port and selection_initiated and not filter_browsers
falsepositives:
  - Rare legitimate services using these ports (validate per environment)
level: high

// Hunt 1: Sideloading pattern - AI-branded processes running from user-writable paths
DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("ChatGPT.exe", "Claude.exe", "Claude Desktop.exe", "OpenAI.exe")
   or InitiatingProcessFileName in~ ("ChatGPT.exe", "Claude.exe", "Claude Desktop.exe", "OpenAI.exe")
| where FolderPath has_any ("\\AppData\\", "\\Downloads\\", "\\Temp\\", "Users\\Public")
| extend IsSignedPath = FolderPath has_any ("Program Files", "Windows\\System32")
| where not(IsSignedPath)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | project DeviceName, ProcessCommandLine, FileName, AccountName, TimeGenerated
) on DeviceName
| summarize arg_max(TimeGenerated, *) by DeviceName, FolderPath

// Hunt 2: Miner indicators - Stratum connections and miner command lines
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort in (3333, 4444, 5555, 7777, 14444, 45700)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("stratum+tcp", "stratum+ssl", "--donate-level", "xmrig", "--algo=rx/", "supportxmr", "minexmr")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, AccountName)
| summarize arg_max(TimeGenerated, *) by DeviceName

-- Yoba campaign hunt: miner processes, Stratum connections, and fake AI client persistence
SELECT * FROM {
  -- Suspicious processes with miner-style command lines
  SELECT 'process' AS IndicatorType, Pid AS Pid, Name AS Name,
         CommandLine AS Detail, Exe AS Path, Username AS User, CreateTime AS Timestamp
  FROM pslist()
  WHERE CommandLine =~ '(?i)(stratum\+(tcp|ssl)|donate-level|xmrig|--algo=rx/|supportxmr|minexmr)'
     OR Exe =~ '(?i)(ChatGPT|Claude|OpenAI)'
     AND Exe =~ '(?i)(AppData|Downloads|Temp|Users\\\\Public)'
}, {
  -- Established connections to common mining pool ports
  SELECT 'network' AS IndicatorType, Pid AS Pid, Name AS Name,
         (RemoteAddr.IP + ':' + format(format='%d', args=RemoteAddr.Port)) AS Detail,
         '' AS Path, '' AS User, '' AS Timestamp
  FROM netstat()
  WHERE Status =~ 'ESTABLISHED'
    AND RemoteAddr.Port IN (3333, 4444, 5555, 7777, 14444, 45700)
}

# Yoba Campaign - Endpoint Audit and Remediation Script
# Run elevated. Produces a report; use -Remediate to kill miner processes.
param([switch]$Remediate)

$report = @()
Write-Host "[*] Yoba campaign endpoint audit starting..." -ForegroundColor Cyan

# 1) Find AI-branded executables in user-writable paths and verify signatures
$searchPaths = @("$env:LOCALAPPDATA", "$env:APPDATA", "$env:USERPROFILE\Downloads", "C:\Users\Public", "$env:TEMP")
$aiNames = @("ChatGPT.exe", "Claude.exe", "Claude Desktop.exe", "OpenAI.exe")
foreach ($base in $searchPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Include $aiNames -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            $report += [pscustomobject]@{
                Type = 'AIBinary'; Path = $_.FullName
                SignatureStatus = $sig.Status; Signer = $sig.SignerCertificate.Subject
            }
            if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'OpenAI|Anthropic') {
                Write-Host "[!] SUSPICIOUS AI binary: $($_.FullName) - Signature: $($sig.Status)" -ForegroundColor Red
            }
        }
    }
}

# 2) Detect miner-style processes by command line
$minerProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match '(?i)(stratum\+(tcp|ssl)|donate-level|xmrig|--algo=rx/|supportxmr|minexmr)'
}
foreach ($p in $minerProcs) {
    Write-Host "[!] MINER PROCESS: PID $($p.ProcessId) - $($p.Name) - $($p.CommandLine)" -ForegroundColor Red
    $report += [pscustomobject]@{Type='MinerProcess'; Path=$p.ExecutablePath; SignatureStatus='N/A'; Signer=$p.CommandLine}
    if ($Remediate) { Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue }
}

# 3) Check established connections to common Stratum pool ports
$poolPorts = @(3333,4444,5555,7777,14444,45700)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $poolPorts -contains $_.RemotePort } | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] POOL CONNECTION: $($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
        $report += [pscustomobject]@{Type='PoolConnection'; Path=$proc.Path; SignatureStatus='N/A'; Signer="$($_.RemoteAddress):$($_.RemotePort)"}
    }

# 4) Enumerate persistence: Run keys and scheduled tasks referencing user-writable AI binaries
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match '(?i)(ChatGPT|Claude|OpenAI|xmrig|miner)' -and $val -match '(?i)(AppData|Downloads|Temp|Public)') {
                Write-Host "[!] PERSISTENCE: $key\$($_.Name) = $val" -ForegroundColor Red
                $report += [pscustomobject]@{Type='Persistence'; Path="$key\$($_.Name)"; SignatureStatus='N/A'; Signer=$val}
            }
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match '(?i)(AppData|Downloads|Temp)' -and ($_.Actions.Execute -match '(?i)(ChatGPT|Claude|OpenAI|xmrig)') } |
    ForEach-Object { Write-Host "[!] SUSPICIOUS TASK: $($_.TaskName) -> $($_.Actions.Execute)" -ForegroundColor Red }

$report | Export-Csv -Path "$env:TEMP\yoba_audit_report.csv" -NoTypeInformation
Write-Host "[*] Audit complete. Report: $env:TEMP\yoba_audit_report.csv" -ForegroundColor Cyan