Yoba campaign fake AI app and DLL sideloading software inventory hunt

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects artifacts and execution patterns associated with the Yoba campaign involving fake AI applications (such as ChatGPT, Claude, Codex) containing malicious setup files, sideloaded DLLs (winmm.dll, wmpdui.dll), and cryptocurrency miners (XMRig).