Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
64
Organization
Check Point
- Mentions · 7d9
- Mentions · 30d21
- All mentions51
- First seenAug 12, 2026
- Last mentioned15h ago
Timeline
51 articles · newest firstFake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
64
INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
68
Attackers abuse enterprise AI tools for theft, C2, and agent hijacking
A fake Postmark MCP package siphoned mail after 15 clean versions, and SesameOp hid C2 in the OpenAI Assistants API.
52
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
Aokigahara infostealer steals ChatGPT, Claude, Codex, and Cursor logins
Check Point says the Windows stealer also grabs cloud, SSH, and browser secrets, not via flaws in those AI apps.
68
Check Point uses OpenAI Daybreak to speed vulnerability research
The company says analyst work that took hours now takes minutes and is building agentic network security that needs human approval.
28
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Antidetect browsers plus AI automation can scale account fraud, Check Point says
Check Point says Kameleo, AdsPower and MultiLogin profiles, proxies and stolen cookies can hide bulk fake accounts and phishing.
48
Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
66
Check Point weekly brief: utility and app breaches, exploited zero-days
CenterPoint says more than 1 million Texans were exposed, while Burger King Japan cites about 11.18 million members.
64
Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)
SANS argues defenders should build small least-privilege AI agents rather than caging general-purpose ones, citing Check Point's tool-call deviation detection.
45
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
Check Point warns LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 can give any user admin access and code execution.
80
10 Best Secrets Detection Tools Compared (2026): Features & Pricing
A 2026 comparison ranks ten secrets-detection tools, from GitGuardian and TruffleHog to free GitHub and Gitleaks scanning.
18
When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point found patched LiteLLM flaws enabling config takeover, file read, RCE, and key theft.
76
Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings
Leaked internal files expose Luna Moth's phone-based social engineering operation, where paired callers and remote-access operators extort victims' data.
62
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
ASOS Hacked – App Users Receive Notifications Sent by Hackers
ASOS is investigating unauthorized customer app alerts after hackers claimed they compromised its Snowflake environment.
68
Shares in British clothing company ASOS dive after hackers apparently send push notification
ASOS shares fell over 10% after an unconfirmed app alert claimed hackers compromised its Snowflake data environment.
60
5th October – Threat Intelligence Report
Check Point's weekly digest covers exploited Citrix and Cisco critical flaws, major breaches, and South African aviation ransomware.
65
Security Teams Can Now Monitor Claude Chats, Files and AI Agent Activity
Claude's Compliance API lets security teams monitor chats, files, and AI agent activity in SIEM and DLP tools.
58
28th September – Threat Intelligence Report
Check Point's weekly report covers ShinyHunters' FBI jobs-site breach, Bitget's $351.6M wallet theft, and actively exploited critical RCEs in Check Point and F5 products.
80
11 Best GCP Security Tools Compared (2026): Features & Pricing
A 2026 buyer's guide ranks 11 GCP security tools, leading with Security Command Center and Wiz.
20
CISA Warns of Multiple Check Point Product Vulnerabilities Exploited in Attacks
CISA says two Check Point flaws, including unauthenticated remote code execution, are being exploited.
88
Check Point Pre-Auth Flaws Under Attack
Check Point says two critical pre-authentication flaws, including CVE-2026-85102, are being actively exploited.
84
Jev Is Not a Language Model, but It Breaks Like One
Check Point shows TypeSafe AI's Jev decision model can be prompt-injected into flipping verdicts for about 50 cents.
58
Hackers Exploit Critical Check Point VPN Flaws to Gain Remote Access Without Login
Check Point confirms active exploitation of two CVSS 9.8 VPN and management flaws enabling unauthenticated code execution.
88
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.
82
InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
Check Point Patches Exploited Management Server Zero-Day
Check Point patched exploited zero-day CVE-2026-93616 in Management Server, and CISA added it and CVE-2026-85102 to KEV.
86
Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers
Check Point says CVE-2026-93616 is exploited to run code on unauthenticated management servers.
84
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point issued emergency hotfixes for actively exploited critical path traversal CVE-2026-93616 in Security Management Server.
85
Check Point Management Server 0-Day Vulnerability Actively Exploited in Attacks
Check Point says attackers exploited critical Management Server zero-day CVE-2026-93616 for unauthenticated code execution.
88
New Check Point flaw lets hackers execute code with root privileges
Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.
80
Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication root RCE in Security Management and Log Servers; no exploitation observed.
65
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.
66
Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication
Check Point patched CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow enabling remote root code execution on Security Management and Log Servers.
72
Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems
Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.
50
12 Best Endpoint Encryption Software Compared (2026): Features & Pricing
2026 buying guide compares 12 endpoint encryption tools, framing paid products as management layers over free BitLocker and VeraCrypt engines.
10
Related CVEs
by mentions- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
- Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding
- CVE-2026-162324%9.3Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
- CVE-2026-3502925%8.7Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE
- Authenticated SSRF in LiteLLM Proxy via user_config
- CVE-2026-5075185%9.3Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways
- CVE-2026-9412725%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-688209%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
Appears with
- Check Pointvendor · 25
- Security Management Serverproduct · 7
- Microsoftvendor · 7
- OpenAIvendor · 6
- Anthropicvendor · 5
- Log Serverproduct · 5
- CISAorganization · 5
- SmartEventproduct · 4
- Claudeai model · 4
- XMRigmalware · 4
- SmartConsoleproduct · 4
- Claudeproduct · 4
- YobaLoadermalware · 4
- Microsoftorganization · 4
- Ciscoorganization · 3
- LiteLLMproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.