A new cybercrime campaign uses fake AI apps with real-sounding names to infect people curious to try the newest tools

Cybercriminals have launched a new scheme that employs fake artificial intelligence applications, bearing real-sounding names, to infect unsuspecting individuals eager to explore the latest technological tools. The malicious software, known as Yoba, infiltrates victims' systems, establishes persistence, and ultimately deploys XMRig, a cryptocurrency mining tool.

This campaign, discovered by security experts from Check Point Research, targets popular AI tools like GPT and Claude. Criminals create counterfeit downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, hosting them on GitHub. While threat actors typically employ various tactics to enhance the legitimacy of their fraudulent software on GitHub, such as artificially inflating download numbers and posting fake comments, they have omitted these additional steps in this instance.

Even more concerning is the fact that the malicious pages are frequently appearing at the top of Google's search engine results pages for specific keywords, which indicates that the attackers have invested significant resources in SEO poisoning. SEO poisoning involves purchasing numerous articles, blogs, and social media posts on the dark web, linking each back to the desired GitHub page. This practice boosts the page's visibility on search engines, making it more likely for potential victims to encounter it.

To further deceive victims, the attackers have developed separate GitHub websites, offering descriptions of the applications and linking directly to the downloadable installation files. The use of SEO poisoning has become increasingly prevalent, even in the age of AI, as tools can now generate a large number of low-quality texts at a fraction of the previous cost. However, Google continues to work on labeling these texts as spam.

Once victims download and execute the malware, they believe they are obtaining a standalone client for an AI tool. In reality, they have unknowingly installed Yoba. This malware establishes persistence on the victim's device by creating a mechanism that launches it automatically upon system restart. The Yoba malware then verifies the device's location to ensure it is not in a sandbox or a country deemed "friendly."

It also delays execution for two weeks to complicate analysis and checks the computer's keyboard to avoid infecting systems from specific countries like Russia, Belarus, Kazakhstan, and Uzbekistan. The final step involves contacting a command and control server to download the XMRig payload, which enables the cybercriminals to mine Monero cryptocurrency on the victim's device, ultimately generating substantial revenue while the victim faces inflated energy and compute bills.