Check Point Research published an analysis on 27 October, credited to the handle Tera0017, of a campaign that hands victims a working installer for the software they went looking for.

Start with what is not malicious, because it matters. The OpenAI Setup.exe and the Anthropic Setup.exe found in these archives are genuine, correctly signed vendor installers. Neither company shipped anything bad. The malicious part is a file sitting next to them called winmm.dll, which the real signed installer loads on startup because Windows looks in the application's own folder first. That technique is DLL sideloading, and it is old enough to be unfashionable.

The lure

The archives are offered by fake GitHub projects pretending to be desktop apps, with names chosen to look like products that might exist: GPT-5.6 Sol, GPT-6 Astra and Claude Opus. Check Point counted 4 repositories, each paired with a GitHub Pages site carrying the download links, and says they reach victims through search results rather than advertising, which it calls SEO poisoning.

One detail is worth noting for anyone who screens repositories by eye. Check Point found no fake stars and no fake forks on these. The usual tell was not there.

What the DLL does

The spoofed winmm.dll has its exports stripped and the real code in DllEntryPoint. It copies WMPDMC.exe, a legitimate Windows binary, out of System32 and into a folder called WMProcess under ProgramData. It then decrypts an embedded payload to a file called wmpdui.dll and sideloads that through the copied binary. The same trick twice.

Persistence is a scheduled task that runs at boot with a 3-minute delay, as Local System. Its author field says Microsoft Corporation. Its description says it collects device metadata for Windows Media Player.

Before any of that, the dropper checks for administrator rights and for the system's language settings, and compares hashes of running process names against a list to decide whether it is being watched. Check Point's note on why the archives are not password protected is the quiet insult in the report: their detection rates were already low enough.

The part worth the headline

The loader does not carry a list of servers. It works out where to call home by reading a picture.

It fetches the profile image of a Telegram channel and seeds a domain generation algorithm from the last 50 bytes of that image. The generated name is then resolved through Google's DNS-over-HTTPS interface, which returns a TXT record. The record is verified with Ed25519 and decrypted with AES. The encrypted payload itself sits on a public file host. The final stage reaches an onion address through a local Tor proxy.

The consequence is that the operator can move infrastructure by changing a profile picture on a channel anyone can view. There is no server to seize at the start of that chain.

We checked the channel ourselves on 3 November, through Telegram's public preview rather than the app. It is still live. It is called YOBA, and it describes itself as the fanclub of a Russian meme.

And then the payload is a miner

After the signed-binary abuse, the double sideload, the fake Microsoft task, the picture-seeded domain algorithm, the signature checking and the Tor routing, the thing that lands is XMRig 6.26.0. A Monero miner.

Check Point adds the caveat that keeps this from being a punchline, and it should be quoted rather than smoothed over: the loader is generic. It can inject into svchost.exe, run an executable from the temporary folder, or run PowerShell. Nothing in the chain is specific to mining, so the next wave need not be a miner.

On attribution

Check Point says indicators suggest Russian origins and that the operation runs primarily in the UTC-4 time zone, while noting that the uploader time zones differ across the repositories, at UTC+4, UTC-4 and UTC+3, and may be set deliberately. Those are its words and its hedges.

The malware declines to run on systems using Russian and several other CIS keyboard languages. Earlier versions excluded only Russia, so the exclusion list grew.

What to do

  • Do not download desktop clients from search results. Both vendors publish from their own domains, and neither distributes through a third-party GitHub project.
  • Alert on a scheduled task created at Local System whose author claims Microsoft Corporation but whose binary is not under Windows or Program Files.
  • Watch for a copy of a System32 executable appearing under ProgramData. That move is the whole technique and it is cheap to detect.
  • Treat DNS-over-HTTPS from a non-browser process as an event worth looking at.
  • Check for Tor client traffic from endpoints that have no business making it.
  • If you find this, assume the miner is the least of it. The loader runs whatever it is sent next.

What is not established

  • Who is behind it. Check Point offers indicators, not a named actor.
  • How many people installed these. No victim count is published.
  • Whether the time zone evidence means anything. Check Point says it may be deliberate.
  • Whether anything other than the miner has been delivered. The loader can, and the report does not say it has.
  • Whether GitHub has removed the repositories, and whether new ones have appeared under different product names.
  • Who runs the Telegram channel, or whether its operators know what the picture is being used for.