Cybercriminals use fake AI apps on GitHub to spread Yoba malware via SEO poisoning
Cybercriminals are leveraging the popularity of AI tools to distribute the Yoba malware through fake clients hosted on GitHub. The campaign uses SEO poisoning to trick users into downloading malicious software that deploys cryptominers, targeting global victims while avoiding systems in select countries.
Editor, Lazyfounder
How the malware campaign works
According to TechRadar, cybercriminals are distributing the Yoba malware by hosting fake clients for AI tools such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus on GitHub. These fake apps appear in Google search results due to SEO poisoning, a technique where attackers manipulate search rankings by purchasing backlinks from articles, blogs, and social media posts on the dark web.
Victims who download these fake clients unknowingly install Yoba, which establishes persistence on the infected device. The malware delays execution for two weeks, making it harder to detect, and avoids infecting systems in Russia, Belarus, Kazakhstan, and Uzbekistan. Once active, Yoba deploys XMRig, a legitimate open-source tool used to mine Monero cryptocurrency, monetizing the victim’s computing and electricity resources.
SEO poisoning and AI-generated content
Unlike typical malware campaigns, the attackers did not artificially inflate GitHub metrics like download counts, stars, or forks. Instead, they relied on SEO poisoning to rank their fake GitHub pages at the top of Google search results for keywords related to AI tools. This method exploits Google’s search algorithms, which inadvertently prioritize these poisoned pages.
The rise of AI-generated content has made SEO poisoning easier, as attackers can quickly create large volumes of low-quality content to manipulate search rankings. While Google is working to label AI-generated spam, the process remains incomplete, leaving users vulnerable to such campaigns.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
This campaign highlights a growing trend where cybercriminals exploit the hype around AI tools to distribute malware. For founders and operators—particularly those in AI, cybersecurity, or software development—this serves as a reminder of the risks posed by third-party repositories and search-driven traffic. Startups building AI products or leveraging open-source platforms like GitHub should prioritize educating users on verifying sources and implementing stricter monitoring of downloadable assets to mitigate the risk of malware distribution.
Related on Lazyfounder
Sources
- TechRadar · 2026-10-29
A new cybercrime campaign uses fake AI apps with real-sounding names to infect people curious to try the newest tools
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
