Home / Technology / AI Scammers Exploit GitHub for Malware
AI Scammers Exploit GitHub for Malware
29 Oct
Summary
- Attackers use SEO poisoning on GitHub to lure victims.
- Yoba malware deploys XMRig to mine Monero cryptocurrency.
- Fake AI clients like GPT and Claude are used to distribute malware.
Cybercriminals are exploiting the intense public interest in artificial intelligence to distribute malware. The attackers are reportedly using SEO-poisoned GitHub pages, which are designed to appear at the top of search engine results for specific keywords. These pages host fake downloadable clients for popular AI tools, including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus.
When unsuspecting users download and run these executables, they are infected with a malware strain known as Yoba. This malware establishes persistence on the victim's system, evades detection by analysis tools, and can delay its execution for up to two weeks. It also includes checks to avoid infecting systems in specific countries like Russia, Belarus, Kazakhstan, and Uzbekistan.
Once Yoba has compromised a system, its final payload is typically XMRig, a cryptomining program. XMRig is used to mine the privacy-focused Monero cryptocurrency, leveraging the victim's computing power and electricity resources. This illicit mining operation allows attackers to generate cryptocurrency, leaving victims with increased energy costs and degraded system performance.
