Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
64
- Mentions · 7d9
- Mentions · 30d34
- All mentions39
- First seenSep 7, 2026
- Last mentioned13h ago
Timeline
39 articles · newest firstFake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
62
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
64
Banking trojans infect 17,960 Android phones in India
Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.
74
CyberDakait malware hits 17,960 Indian banking Android devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
72
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
68
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
74
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
68
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
64
Claude Code reportedly finds XMRig using 1175% CPU on a Mac
A Reddit user says a LaunchAgent and pool.hashvault.sh kept the miner alive; the report is unverified.
32
Claude Code reportedly finds hidden XMRig miner on a Mac
A Reddit user says the assistant saw about 1,175% CPU use and a LaunchAgent dated August 29; the report is unverified.
36
Attackers use Plex2Shell to mine crypto on vulnerable Plex servers
A public proof of concept for four Plex flaws was used within a day to drop XMRig and proxy software on a honeypot.
74
Attackers exploit Plex2Shell flaws to install miners and a proxy
Four chained bugs give unauthenticated remote code execution; Plex fixed them in 1.43.3.10861 on August 3.
78
Plex Media Server flaws exploited in the wild to drop a miner
A honeypot saw RCE attempts from three IPs, then a miner and a proxy called myawesomeproxy.
76
Plex2Shell chain used against Plex servers a day after disclosure
A honeypot saw the public exploit drop an XMRig miner and later proxy software called myawesomeproxy.
76
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
72
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
88
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ahsay re-patched exploited AhsayCBS flaws after incomplete fixes still allowed web shells and XMRig miners.
80
CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
Attackers are chaining AhsayCBS authentication-bypass and critical RCE flaws to deploy webshells and cryptominers.
80
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Round 118 collects reports on ClingSTUN, npm supply-chain theft, AhsayCBS exploitation, and other malware campaigns.
36
Security Affairs newsletter Round 599 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs round 599 collects weekly headlines on breaches, arrests, ransomware, and exploited flaws.
32
Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers
Attackers are exploiting two AhsayCBS zero-days for unauthenticated SYSTEM access on exposed backup servers.
78
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
82
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Attackers exploit unpatched AhsayCBS flaws to plant JSP webshells and XMRig miners at five organizations.
81
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge.
78
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Huntress says attackers are exploiting unpatched AhsayCBS flaws for unauthenticated RCE, webshells, and cryptominers.
78
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Huntress saw attackers chain two AhsayCBS flaws for SYSTEM RCE, webshells, and XMRig mining.
82
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.
78
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
74
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.
78
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
80
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
PoeLLM malware has infected over 3,400 servers to build a cryptomining botnet called Canto Incognito.
74
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
76
Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
55
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
55
Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners
Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.
50
Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
60
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
72
Related CVEs
by mentions- CVE-2026-10513482%10.0Unauthenticated OS Command Injection in AhsayCBS
- CVE-2026-10513379%6.9Improper authentication in Ahsay AhsayCBS API
- CVE-2026-966562%8.6Admin-Triggered Arbitrary File Write & RCE in Plex Media Server
- CVE-2026-966542%6.9Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-966522%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-966552%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2026-765192%9.8Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- Authenticated Path Traversal in Plex Media Server Exposes PlexOnlineToken
Appears with
- AhsayCBSproduct · 10
- Ahsayvendor · 9
- Huntressorganization · 8
- YobaLoadermalware · 7
- Anthropicvendor · 7
- PoeLLMmalware · 7
- ChatGPTproduct · 6
- OpenAIvendor · 6
- Claudeproduct · 6
- YobaDroppermalware · 6
- Gotenbergproduct · 5
- Giteaproduct · 5
- Plexvendor · 5
- Plex Media Serverproduct · 5
- LiteLLMproduct · 5
- Yobamalware · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.