Check Point Research identified Yoba, a malware campaign distributing malicious installers through fake GitHub repositories and GitHub Pages impersonating AI desktop applications, including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The repositories appeared prominently in Google search results, suggesting SEO poisoning was used to attract potential victims. The malicious ZIP archives contain legitimate, digitally signed OpenAI or Anthropic executables alongside a malicious winmm.dll that executes through DLL sideloading. Researchers also identified an earlier Yoba variant associated with a Cursor AI-themed executable. The campaign targets users seeking AI software downloads, although the research does not identify specific victim organizations or confirm the number of compromised systems.

Once executed with administrative privileges, YobaDropper deploys YobaLoader as wmpdui.dll alongside a legitimate WMPDMC.exe executable in C:\ProgramData\WMProcess\, establishing persistence through a scheduled task running as SYSTEM. YobaLoader retrieves a Telegram channel profile image to generate a domain using a domain generation algorithm (DGA), then queries Google’s DNS-over-HTTPS service for encrypted instructions directing it to additional payloads hosted on Catbox. The loader supports process injection, executable deployment, and PowerShell execution. Check Point observed the delivery of an XMRig cryptocurrency miner injected into svchost.exe, with mining communications routed through Tor. The malware also employs process-name validation, language-based exclusions, and execution delays to evade analysis. Although the loader can deliver other payloads, additional malware families were not confirmed.

Impact: Yoba poses a threat to organizations whose users install AI-related applications from unverified repositories. Successful infection can establish persistent, SYSTEM-level malware execution, enable retrieval and execution of additional attacker-controlled payloads, and consume computing resources through unauthorized cryptocurrency mining. Its use of legitimate signed executables for DLL sideloading may complicate detection, while Telegram, DNS-over-HTTPS, and public file-hosting services help conceal payload retrieval. The loader’s flexible execution capabilities create opportunities for additional compromise, although the observed final payload was an XMRig miner. Researchers identified indicators suggesting Russian origins, but definitive attribution remains unconfirmed.

Recommendation:

• Restrict unapproved AI software installations and require users to download applications from verified vendor distribution channels rather than unfamiliar GitHub repositories.

• Monitor DLL sideloading activity involving signed Setup.exe processes loading unexpected winmm.dll files from local installation directories.

• Hunt for persistence artifacts involving scheduled tasks configured to execute WMPDMC.exe from C:\ProgramData\WMProcess\ under the SYSTEM account.

• Review GitHub access and download telemetry for identified malicious repositories, including github[.]com/gpt-5-6/sol-free-desktop, gpt-6-astra[.]github[.]io, and opus-5-0[.]github[.]io.

• Monitor suspicious network communications involving t[.]me/yoba_fanclub, files.catbox[.]moe/z5zpy9.dat, and dynamically generated domains following the pattern adjective-noun-verb-number.dedyn[.]io.

• Hunt for unusual DNS-over-HTTPS requests and process injection, particularly Google DNS TXT lookups for unfamiliar generated domains, suspicious injection into svchost.exe, and hidden PowerShell execution.

• Deploy Check Point’s published YARA rules for YobaDropper and YobaLoader, and investigate unauthorized XMRig mining, Tor activity, and suspicious CPU utilization.

On October 22, 2026, Zscaler Threat Hunting disclosed an SEO poisoning campaign distributing Armorsteal, a newly identified Python-based malware family targeting Windows users searching for Chocolatey package manager installation instructions and Microsoft Activation Scripts (MAS). First identified in September 2026, the campaign used fraudulent websites impersonating legitimate software projects, including choclatey[.]org and massgravel[.]net, to trick users into executing malicious PowerShell installation commands. The fake Chocolatey installer also executed the legitimate installation process, allowing the software to appear functional while silently deploying malware. Both installer variants requested elevated privileges, concealed the PowerShell console, and downloaded an archive containing a Python 3.11 runtime and Pyarmor-protected malware components into C:\Windows\SystemHealth\Update\. Persistence was established through scheduled tasks named SysCheck2 and SysCheckX, configured to execute the remote access module at user logon and system startup, respectively. Researchers linked both distribution websites to the same operation through shared malware components, command-and-control (C2) infrastructure, and an RSA-2048 task-signing key. The fake websites were taken offline by early October, although the operators subsequently modified their infrastructure.

Armorsteal consists of three primary components providing remote access, surveillance, and information theft. The remote access module, SysMon.py, collects system information, communicates with attacker-controlled infrastructure over HTTPS, and polls for new tasks every 60 seconds. Received Python tasks are verified using embedded RSA-2048 signatures before being executed in memory, while version tracking prevents previously executed tasks from running again. The surveillance module, basrq.py, records keystrokes and active window titles, monitors clipboard activity, captures screenshots based on configured keywords, and replaces cryptocurrency wallet addresses with attacker-controlled addresses. The information-stealing module, got.py, extracts browser cookies, saved passwords, Discord tokens, cryptocurrency wallet data, BIP39 seed phrases, SSH keys, and password manager information. It also uses the Chrome DevTools Protocol on port 9222 and downloads a publicly available Chrome decryption tool to access protected browser credentials. Armorsteal employs Pyarmor obfuscation and cloud-environment detection to complicate analysis. Zscaler identified infrastructure changes involving workerstats[.]net, pymons[.]is, and datamons[.]org, demonstrating continued operational adjustments during the investigation.

Impact: Armorsteal presents a significant threat to organizations through unauthorized remote access, credential theft, persistent surveillance, and financial fraud. Successful infection could allow attackers to execute additional Python payloads, capture employee keystrokes and screenshots, steal browser authentication cookies, and compromise accounts associated with password managers, Discord, and other applications. Its cryptocurrency clipboard hijacking and seed phrase collection capabilities could enable theft of digital assets, while stolen SSH keys and authentication data may provide opportunities for additional unauthorized access. The use of scheduled tasks with elevated privileges supports persistence across system restarts, and its remote task execution functionality allows operators to modify malware behavior after initial compromise. The campaign’s use of legitimate software installation instructions increases the likelihood of users executing malicious commands, particularly administrators and developers who regularly install software through PowerShell. Although Zscaler confirmed the malware’s capabilities and distribution infrastructure, the research does not establish a specific victim count or confirm broader enterprise compromise.

Recommendation:

• Block and monitor identified malicious infrastructure, including choclatey[.]org, massgravel[.]net, workerstats[.]net, pymons[.]is, datamons[.]org, niceer[.]net, and supertrap[.]net.

• Hunt for suspicious scheduled tasks named SysCheck2 and SysCheckX, particularly tasks configured to launch Python executables at user logon or system startup with elevated or SYSTEM privileges.

• Inspect endpoints for unauthorized files and directories beneath C:\Windows\SystemHealth\Update\, including SysMon.py, basrq.py, got.py, bundled Python runtimes, and associated ZIP archives.

• Review PowerShell execution logs for suspicious installation commands, hidden console execution, privilege elevation, and downloads originating from choclatey[.]org, community[.]choclatey[.]org, or massgravel[.]net.

• Monitor outbound HTTPS traffic for Armorsteal C2 activity, including requests to /receive_infof, /get-global, /get-onetime-code/, /black-watch/, and /infame/receive/, where URL paths are visible in network telemetry.

• Investigate browser processes launched with –remote-debugging-port=9222, particularly when associated with unexpected Python processes or unauthorized access to browser authentication data.

• Monitor endpoint behavior associated with credential theft, including suspicious access to password manager databases, browser cookie stores, SSH private keys, Discord tokens, and cryptocurrency wallet files.

• Review Microsoft Defender exclusions and endpoint security configurations for unauthorized changes, particularly exclusions affecting C:\Windows, which may allow malicious components to evade security scanning.

• Restrict untrusted PowerShell installation commands through application control policies, least-privilege access, and approved software installation procedures. Educate users to verify official software domains before executing commands copied from search results.

• If Armorsteal is detected, isolate affected endpoints and investigate persistence, remove malicious scheduled tasks and payloads, revoke potentially compromised authentication sessions, rotate exposed credentials, and assess cryptocurrency wallet exposure.

On October 23, 2026, Check Point Research disclosed Aokigahara, a newly observed infostealer identified in the wild that expands traditional credential theft to include AI applications and developer environments. Earlier versions of the malware may have been known as Kamidere or Stygian. Aokigahara targets authentication files, session data, and configuration files associated with ChatGPT Desktop, Claude, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other AI-assisted development tools. Its collection capabilities also extend to AWS, Azure, and Google Cloud credentials, Git authentication files, SSH private keys, browser passwords and cookies, cryptocurrency wallets, VPN configurations, password managers, and messaging applications. The malware can capture screenshots and clipboard contents, collect files from user directories, and deploy a separate cryptocurrency clipboard-manipulation component. Although the malware has been observed in the wild, the research does not establish a specific distribution method, threat actor attribution, or confirmed victim count.

Aokigahara uses a modular architecture controlled by an encrypted configuration stored in the .stgcfg section, which contains its command-and-control (C2) configuration, enabled collection modules, and anti-analysis settings. The malware employs AES-256-CBC to decrypt its configuration and uses an X25519 key exchange to establish encrypted communications with its C2 infrastructure. Collected data is packaged into ZIP archives, encrypted using AES-256-GCM, and transmitted through HTTP POST requests to /gate/handshake, /gate/chunk, and /gate/complete. The malware also implements optional anti-debugging, virtual machine detection, sandbox checks, and language-based execution restrictions that include Russian, Ukrainian, Belarusian, and several other regional language settings. Its use of dynamic Windows API resolution and control-flow obfuscation further complicates analysis. While the malware’s collection capabilities are confirmed through code analysis, researchers did not establish how operators monetize the stolen information.

Impact: Aokigahara presents a significant credential theft and data exposure risk to organizations using AI-assisted development tools, cloud platforms, and traditional enterprise applications. Compromised AI authentication tokens or session data could potentially allow attackers to access paid AI services, private conversations, uploaded documents, and sensitive development information, depending on the permissions and validity of the stolen credentials. Exposure of Git credentials, SSH private keys, and cloud authentication files could facilitate unauthorized repository access, cloud resource compromise, and additional intrusion activity. Browser session theft and password manager targeting may also enable account takeover, while the malware’s clipboard-manipulation component introduces potential cryptocurrency theft risks. Although these capabilities create opportunities for financial fraud, unauthorized AI service consumption, and data extortion, the research does not confirm that these downstream activities have occurred.

Recommendation:

• Deploy and maintain endpoint detection and response (EDR) protections capable of detecting infostealer behavior, including suspicious credential-store access, browser cookie extraction, screenshot capture, and unauthorized collection of application configuration files.

• Monitor access to AI application authentication files, including .claude\credentials.json, .codex\auth.json, ChatGPT Desktop application storage, and authentication-related files associated with Cursor, Windsurf, GitHub Copilot, and Gemini CLI.

• Audit developer workstations for suspicious access to sensitive files, particularly .aws\credentials, .aws\sso\cache, .ssh private keys, Git credential files, and cloud configuration directories.

• Hunt for suspicious HTTP POST requests involving /gate/handshake, /gate/chunk, and /gate/complete, particularly when accompanied by headers such as X-Build-ID, X-Gate-Token, X-Session, X-HWID, and X-Chunk-Index.

• Implement the YARA detection rule published by Check Point Research to identify Aokigahara samples using embedded strings, configuration markers, and other malware-specific artifacts.

• Investigate suspicious executable behavior associated with anti-analysis techniques, including debugger detection, virtual machine checks, dynamic API resolution, and unexpected process termination based on system language settings.

• Restrict storage of long-lived credentials on developer endpoints by using approved secrets-management solutions, short-lived authentication tokens, and least-privilege access for AI services, cloud environments, and source code repositories.

• Review endpoint activity for unauthorized clipboard manipulation, including suspicious executables or components created beneath C:\Microsoft\Vault, which Check Point identified as a location used by the malware’s clipper deployment mechanism.

• If Aokigahara infection is confirmed, isolate affected systems and revoke potentially exposed credentials, including AI service sessions, API keys, cloud access tokens, Git credentials, SSH keys, browser sessions, and VPN authentication material. Review associated services for unauthorized access before restoring endpoint access.