النتائج المتحققة

لا يوجد

التناقضات والقيود

• UNKNOWN: Check Point Research documented the Yoba Windows malware campaign using fake GitHub/GitHub Pages AI-app lures, signed OpenAI/Anthropic binaries for DLL sideloading, a YobaDropper→YobaLoader chain, public-service-based tasking and an observed XMRig final payload.
• حد الدليل: Victim count, prevalence, intentional geotargeting, named actor identity, non-XMRig deployment or upstream vendor compromise.
• UNKNOWN: On 2026-11-01, direct GitHub API requests for three named Yoba lure repositories returned HTTP 404 / Not Found.
• حد الدليل: Formal takedown, campaign termination, reason for unavailability, absence of replacement infrastructure or absence of prior victimization.

المتابعة المفتوحة

• OPEN [HIGH]: VICTIM_SCALE_CURRENT_ACTIVITY — No confirmed victim count, normalized infection telemetry, independent live EDR/IR validation, or proof that the originally named Yoba lure repositories remain active or have been replaced.
• OPEN [HIGH]: ATTRIBUTION_TARGETING — Actor identity and intentional geographic targeting for Yoba remain unresolved; CIS keyboard exclusions and inconsistent timezone clues do not establish either.

المصادر

1. Check Point Researchhttps://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
2. GitHubhttps://github.com/