Verified Findings

None

Contradictions / Caveats

• UNKNOWN: Check Point Research documented the Yoba Windows malware campaign using fake GitHub/GitHub Pages AI-app lures, signed OpenAI/Anthropic binaries for DLL sideloading, a YobaDropper→YobaLoader chain, public-service-based tasking and an observed XMRig final payload.
• Evidence boundary: Victim count, prevalence, intentional geotargeting, named actor identity, non-XMRig deployment or upstream vendor compromise.
• UNKNOWN: On 2026-11-01, direct GitHub API requests for three named Yoba lure repositories returned HTTP 404 / Not Found.
• Evidence boundary: Formal takedown, campaign termination, reason for unavailability, absence of replacement infrastructure or absence of prior victimization.

Open Follow-up

• OPEN [HIGH]: VICTIM_SCALE_CURRENT_ACTIVITY — No confirmed victim count, normalized infection telemetry, independent live EDR/IR validation, or proof that the originally named Yoba lure repositories remain active or have been replaced.
• OPEN [HIGH]: ATTRIBUTION_TARGETING — Actor identity and intentional geographic targeting for Yoba remain unresolved; CIS keyboard exclusions and inconsistent timezone clues do not establish either.

Sources

1. Check Point Researchhttps://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
2. GitHubhttps://github.com/