Yoba Operators Use Fake GitHub Projects to Spread Crypto Miner, Check Point Finds

Key points

• Check Point spent about two months following Yoba operators’ counterfeit GitHub repositories.
• The lures included GitHub.io landing pages and ZIP downloads hiding malware.
• After infection, the payload installs a cryptocurrency miner.
• Fabricated projects referenced ChatGPT, Claude, GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.
• No CVE was assigned; the risk comes from trust in hosted code and AI-brand naming.

Researchers at Check Point have spent roughly eight weeks following a deceptive software campaign run by the group known as Yoba operators. The operation relies on counterfeit repository pages hosted on GitHub, along with project landing pages on GitHub.io, to convince visitors they are downloading legitimate tools. Rather than publishing source code, the actors package their payloads in ZIP archives attached to releases, turning ordinary download behavior into an infection path.

The campaign’s lures borrow heavily from current AI brands. Names tied to OpenAI’s ChatGPT, Anthropic’s Claude, and model labels such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus appear in the fabricated projects, according to the researchers. That branding is likely meant to attract developers and AI enthusiasts who are searching for new tools, wrappers, or model access. Once a victim opens the downloaded archive and runs its contents, the malware establishes a foothold and drops a cryptocurrency miner, consuming system resources for the operators’ profit.

No CVE is associated with this activity, which is important context: the weakness being exploited is trust in open-source hosting and AI-related naming, not a specific software flaw. The findings, dated October 29, 2026, describe activity observed over the preceding two months. GitHub, OpenAI, and Anthropic are named as the platforms and brands whose services or products were imitated or referenced; the facts do not indicate that any of those vendors suffered a breach.

For K-12 IT teams, the risk is less about a named vulnerability and more about user behavior. Staff and students who search for AI utilities can encounter lookalike repositories, and ZIP downloads from unfamiliar projects can bypass casual scrutiny. Organizations should treat unsolicited repository links as suspicious, restrict execution of downloaded archives where possible, and watch endpoint telemetry for miner-like CPU spikes. The case is a reminder that brand borrowing and free hosting can be enough to turn a fake project into a working malware delivery channel.

What to do now

1. Restrict standard users from executing unsigned binaries and scripts unpacked from ZIP files; enforce application control on endpoints used by staff and students.
2. Block or alert on archive and executable downloads from GitHub.io and unknown GitHub release assets for non-developer user groups.
3. Hunt endpoint and SIEM telemetry for miner indicators: sustained CPU spikes, mining-pool connections, and odd processes launched from Downloads or Temp folders.
4. Add proxy and DNS detections for lookalike repository names referencing ChatGPT, Claude, GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.
5. Brief staff and students on fake AI-tool repositories and ZIP lures, and require verification through official vendor pages before downloading tools.
6. If a host ran a suspicious archive, isolate it, preserve the ZIP and process tree, reset credentials, and scan for persistence.
7. Report abusive repositories to GitHub and apply any hashes or domains shared in Check Point’s research to blocklists.

Original source

Help Net Security