سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Canonical Run ID
ACRIP-MCI-20261101-004
ناجح · PASS
What ran?GENERAL_DISCOVERY
Discover and select the highest-value current malware/campaign development without reopening persisted topics absent material delta; execute full verification, contradiction, dedupe, campaign/infrastructure correlation and canonical commit.
Why this Topic?Yoba / Fake AI Desktop Installer Campaign
Candidate board selected Yoba over NetamLoader and Insolent Werewolf; verified Yoba campaign chain and direct current GitHub 404 state; kept victim scale, replacement infrastructure, non-XMRig deployment, actor identity and geotargeting unresolved.
EVIDENCE
الأدلة وما تثبته
2 سجل
MCI-E-0018
Check Point Research documented the Yoba Windows malware campaign using fake GitHub/GitHub Pages AI-app lures, signed OpenAI/Anthropic binaries for DLL sideloading, a YobaDropper→YobaLoader chain, public-service-based tasking and an observed XMRig final payload.
UNKNOWN
Supports
Campaign identity, observed distribution chain, sideloading mechanism, Yoba components and observed XMRig payload.
Does not prove
Victim count, prevalence, intentional geotargeting, named actor identity, non-XMRig deployment or upstream vendor compromise.
Confidence
غير مسجل
Context
YobaDropper; YobaLoader
Check Point Researchفتح المصدرCY-T2 / Primary Threat Research
MCI-E-0019
On 2026-11-01, direct GitHub API requests for three named Yoba lure repositories returned HTTP 404 / Not Found.
UNKNOWN
Supports
Current public availability state of the named lure repositories.
Does not prove
Formal takedown, campaign termination, reason for unavailability, absence of replacement infrastructure or absence of prior victimization.
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Direct GitHub 404 is current-state evidence only.","Gap ID":"CY-GAP-012","Impact":"Blocks prevalence/current-scale claims and continued-infrastructure claims.","Status":"OPEN","Gap Type":"VICTIM_SCALE_CURRENT_ACTIVITY","Priority":"HIGH","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-005,CY-DOM-007,CY-DOM-008","Description":"No confirmed victim count, normalized infection telemetry, independent live EDR/IR validation, or proof that the originally named Yoba lure repositories remain active or have been replaced.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101-004","Required Evidence / Resolution":"Independent EDR/IR/provider telemetry, victim evidence, or verified replacement/current infrastructure tied to Yoba."}
{"Notes":"Preserve origin indicators as clues, not attribution.","Gap ID":"CY-GAP-013","Impact":"Blocks named-actor or deliberate-geotargeting conclusions.","Status":"OPEN","Gap Type":"ATTRIBUTION_TARGETING","Priority":"HIGH","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-005,CY-DOM-008","Description":"Actor identity and intentional geographic targeting for Yoba remain unresolved; CIS keyboard exclusions and inconsistent timezone clues do not establish either.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101-004","Required Evidence / Resolution":"Independent actor-linked infrastructure/handles/build provenance plus victim/distribution evidence demonstrating intentional geographic selection."}
FOLLOW-UP
المتابعات غير المحسومة
2 مفتوحة
VICTIM_SCALE_CURRENT_ACTIVITY
No confirmed victim count, normalized infection telemetry, independent live EDR/IR validation, or proof that the originally named Yoba lure repositories remain active or have been replaced.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
ATTRIBUTION_TARGETING
Actor identity and intentional geographic targeting for Yoba remain unresolved; CIS keyboard exclusions and inconsistent timezone clues do not establish either.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
GitHubفتح المصدرCY-T3 / Direct Public Platform Artifact
NEW — Yoba campaign chain verified from primary technical research; named GitHub lure repositories currently return 404 via direct API checks; victim scale, current replacement infrastructure, non-XMRig deployment, actor identity and intentional geotargeting remain unproven.