MCI-H-014ACTIVE
Yoba is a documented Windows malware distribution campaign using fake AI-themed GitHub lures and signed-binary DLL sideloading.
Independent EDR/IR victim telemetry and replacement/current infrastructure.
جارٍ تحميل البيانات التشغيلية
TOPIC
Yoba campaign identity, fake AI-desktop delivery, signed-binary DLL sideloading, current infrastructure state, victim scale, payload deployment breadth, actor attribution and geographic-targeting intent.
1
2
2
3
2
NEW — Yoba campaign chain verified from primary technical research; named GitHub lure repositories currently return 404 via direct API checks; victim scale, current replacement infrastructure, non-XMRig deployment, actor identity and intentional geotargeting remain unproven.
MALWARE_CAMPAIGN_RESEARCH_TOPIC
—
—
—
Yoba is a documented Windows malware distribution campaign using fake AI-themed GitHub lures and signed-binary DLL sideloading.
Independent EDR/IR victim telemetry and replacement/current infrastructure.
Yoba has deployed non-XMRig payloads in the observed campaign.
Independent sample/incident evidence of another delivered final payload.
A specifically identifiable Russian-origin actor operates Yoba and intentionally targets non-CIS victims by geography.
Actor-linked infrastructure/handles/build provenance plus victim/distribution evidence demonstrating intent.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 2 Evidence
Check Point Research documented the Yoba Windows malware campaign using fake GitHub/GitHub Pages AI-app lures, signed OpenAI/Anthropic binaries for DLL sideloading, a YobaDropper→YobaLoader chain, public-service-based tasking and an observed XMRig final payload.
لا يثبت: Victim count, prevalence, intentional geotargeting, named actor identity, non-XMRig deployment or upstream vendor compromise.
فتح Run المصدرOn 2026-11-01, direct GitHub API requests for three named Yoba lure repositories returned HTTP 404 / Not Found.
لا يثبت: Formal takedown, campaign termination, reason for unavailability, absence of replacement infrastructure or absence of prior victimization.
فتح Run المصدرNo confirmed victim count, normalized infection telemetry, independent live EDR/IR validation, or proof that the originally named Yoba lure repositories remain active or have been replaced.
Independent EDR/IR/provider telemetry, victim evidence, or verified replacement/current infrastructure tied to Yoba.
Actor identity and intentional geographic targeting for Yoba remain unresolved; CIS keyboard exclusions and inconsistent timezone clues do not establish either.
Independent actor-linked infrastructure/handles/build provenance plus victim/distribution evidence demonstrating intentional geographic selection.