Yoba Campaign Sideloading Signed OpenAI Binaries to Deploy Miners via Telegram DGA

Threat actors uploaded ZIPs containing legitimate signed OpenAI Codex executables paired with malicious winmm.dll droppers to GitHub repositories using three distinct Outlook addresses and UTC offsets. The dropper hashes its host basename against 0xE6C2F326, skips 11 CIS keyboard layouts plus Tatar, then installs persistence via scheduled task and extracts YobaLoader after decrypting an embedded payload.

Check Point telemetry shows the loader repeats the hash check against 0x552751E3, pulls a Telegram image seed from t.me/yoba_fanclub, and generates adjective-noun-verb-digit.dedyn.io domains queried via Google DoH TXT records. This mirrors prior supply-chain abuses documented in 2023-2024 campaigns that also abused signed binaries for initial access without exploiting zero-days.

The regional exclusions and deliberate timezone variance indicate operators with operational familiarity of post-Soviet enforcement patterns while testing SEO surface on GitHub.io pages. Absence of Ukraine from the blocklist is a notable shift from earlier Russian-language malware families.

Next stage payloads hosted on catbox.moe will likely rotate to new file hosts once takedowns begin; defenders should monitor for new GitHub projects claiming unreleased GPT or Claude desktop clients.