YOBADROPPERYobaDropper

Dropper of the Yoba malware chain reported and named by Check Point Research, distributed through fake GitHub projects and GitHub Pages sites posing as desktop applications for GPT-5.6 Sol, GPT-6 Astra and Claude Opus, promoted by SEO poisoning, and earlier (June 2026) as Cursor. Delivered as winmm.dll in unprotected ZIP releases and side-loaded by legitimate signed OpenAI and Anthropic Setup.exe binaries, it checks the DJB2 hash of its host process name (stalling for about 13 days in a sandbox), skips CIS keyboard layouts except Ukrainian, requires administrator rights, then drops the XOR-encrypted YobaLoader as wmpdui.dll beside a copy of WMPDMC.exe in ProgramData\WMProcess and persists through a SYSTEM scheduled task masquerading as Windows Media Player. Check Point reports indicators of Russian origin and an operator in UTC-4; the campaign is not attributed to a known actor.