New Cybercrime Campaign Spreads Cryptojacking Malware via Fake AI Apps and SEO Poisoning

Security researchers have uncovered a new cybercrime campaign that leverages public interest in emerging artificial intelligence tools to distribute malware. According to reports from Check Point Research (CPR), anonymous threat actors have created fake downloadable clients for prominent AI products—including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus—and hosted them on GitHub.

How the SEO Poisoning Attack Works

Unlike campaigns that artificially inflate GitHub metrics with fake stars, forks, and comments to manufacture credibility, this operation relies heavily on Search Engine Optimization (SEO) poisoning to capture victim traffic.

• Dark Web Promotion: Attackers allegedly purchase hundreds or thousands of low-quality articles, blog posts, and social media mentions across the dark web.
• Search Manipulation: These distributed links point back to the malicious GitHub repositories, signaling to search engines that the pages are relevant and popular.
• Top Search Placement: As a result, the fraudulent download pages appear near the top of Google search results for specific keywords.

Anatomy of the Yoba Malware Infection

When unsuspecting users visit the poisoned GitHub pages and download the executable files, they inadvertently install a malware strain identified as Yoba.

• System Persistence: The malware automatically configures itself to launch upon system reboot, masking its presence as legitimate Windows software.
• Evasion Techniques: Yoba includes checks to detect sandbox environments and security analysis tools. It can delay execution for up to two weeks and inspects system keyboard layouts to bypass devices located in specific regions.
• Cryptomining Payload: After communicating with a command-and-control (C2) server, the malware downloads its final payload: XMRig, an open-source Monero cryptominer.

Practical Implications and Verification

Victims of this campaign typically experience degraded system performance and inflated electricity bills as their computing resources are hijacked to generate privacy-focused cryptocurrency for third parties. Cybersecurity analysts recommend verifying software downloads through official vendor websites, maintaining updated endpoint protection, and exercising caution when searching for newly announced or unreleased technology products online.