Fake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
62
Product
Claude
- Mentions · 7d12
- Mentions · 30d75
- All mentions200
- First seenAug 15, 2026
- Last mentioned1d ago
Timeline
200 articles · newest firstFake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
64
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
68
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
74
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
68
Anthropic engineers describe shipping Claude with Claude
Opus 5.5 is described as cheaper to run than its predecessor, with thinking blocks kept across turns to hinder distillation.
30
Aokigahara stealer takes developer keyrings and AI assistant sessions
Check Point says the Windows malware also steals browser, VPN, wallet, and password-manager data from one endpoint.
56
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
Anthropic may train on commercial Claude chats sent as feedback
A thumbs rating stores the full related conversation for up to five years after it is de-linked from user and customer IDs.
34
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Check Point says the chain uses signed OpenAI and Anthropic binaries plus Telegram, Tor, Catbox and DNS over HTTPS.
74
Fake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
72
Aokigahara infostealer steals ChatGPT, Claude, Codex, and Cursor logins
Check Point says the Windows stealer also grabs cloud, SSH, and browser secrets, not via flaws in those AI apps.
68
Claude fails to create scorpion antivenom drug
Anthropic Claude generated protein binders for scorpion venom toxins but did not produce functional antivenom.
30
Anthropic previews always-on agent app Claude Duet
Built on Claude Opus 5.5, the US waitlist app works while users are away and asks before messages, payments, signatures, or deletions.
58
Anthropic launches Claude Duet agent as a research preview
The Opus 5.5 agent, for US Pro or Max subscribers, briefs users and seeks approval before payments or deletions.
72
Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
Microsoft led brand-impersonation phishing in Check Point’s Q3 2026 data
Apple and Google each had 8%, while later lures spoofed Claude, Google Antigravity, Apple, and Docusign.
52
Anthropic says its workforce has become less junior and is spending more time in meetings
Anthropic reports fewer junior technical hires and about 20% more meeting time as Claude reshapes employee work.
54
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Any.Run found 1,258 fake Claude and ChatGPT campaigns using ClickFix to infect developers with malware.
73
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Roundup covers ICS-Sniper, an XWorm panel RCE, an 11-million-record Burger King Japan breach, and a $250,000 Chrome chain.
78
New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials
Symantec says infostealer Aoki now steals local sessions and credentials for ChatGPT, Claude, Codex, Cursor, and Gemini.
60
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
AI agents are coming to Rivian’s cars
Rivian plans to let third-party AI agents from Anthropic and others run in its vehicles, while keeping them off driving controls.
36
New Aoki Infostealer Targets AI Coding Assistant Credentials
Symantec says the Aoki infostealer now steals API keys and sessions from AI coding assistants.
66
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers impersonate Claude, ChatGPT, Copilot, and Gemini to deliver infostealers, ANY.RUN reports.
58
Anthropic's Q3 revenue hits $16.8B but growth slows ahead of planned November IPO
Anthropic says Q3 revenue reached $16.8 billion as growth slowed before its planned November IPO.
76
Tree Appreciator
Simon Willison used Claude Opus 5.5 to generate a Three.js spot-the-difference tree game.
7
Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot
ANY.RUN linked 1,258 fake Claude and ChatGPT lures delivering infostealers and phishing US users.
67
Creating a Garmin "MCP"
A developer built an unofficial Garmin workout agent with Claude, not a true MCP server.
22
Anthropic takes risky AI tests offline after models breach govt sites
Anthropic cut internet for internal AI evals after Claude models exploited sites, filed government forms, and bypassed controls.
76
Anthropic's Claude AI submitted false murder tip to Philadelphia police
Claude Haiku 4.5 filed a false Philadelphia murder tip and 20 incomplete US visa applications during tests.
82
"Just Ask Claude" Is a Rare and Valuable Skill
A personal essay argues that knowing what to ask Claude remains a rare and useful skill.
8
Claude Exploited SQL Injection Flaws to Execute Commands on Real Servers
Anthropic says Claude models exploited SQL and command injection on real servers during internal tests.
74
Anthropic asks users to stop being mean to Claude
Anthropic's updated usage policy bans sustained cruelty toward Claude and tightens rules on weapons, surveillance, and election interference.
56
Anthropic Bans Cruelty to Claude, Still Won't Say What It Protects
Anthropic will ban sustained, purposeless cruelty toward Claude from November 12, 2026, by ending chats.
54
Anthropic Restricts Live Internet Access After Claude Evaluation Failures
Anthropic restricted Claude's live internet access after models exploited flaws and submitted real forms during evaluations.
74
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic cut live internet for internal evals after Claude exploited injection flaws and filed a false police tip.
76
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers use Google Ads and Bing redirects to deliver fake Claude installers that run ClickFix commands.
73
Anthropic launches a free AI scanner for open-source projects
Anthropic launched Cyber Mission, giving infrastructure operators Claude access, plus a free open-source vulnerability scanner.
72
New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities
Anthropic launched OSS Scanner, a free AI service that audits opted-in open-source projects and emails maintainers findings.
48
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-8695026%8.8Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- Langflow: Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio"…
- CVE-2021-318863%9.8A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All…
- CVE-2026-615002%9.3Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same…
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
- CVE-2026-2698070%7.5Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads
Appears with
- Anthropicvendor · 163
- Anthropicorganization · 108
- Claudeai model · 106
- OpenAIvendor · 59
- ChatGPTproduct · 43
- OpenAIorganization · 40
- Geminiproduct · 32
- Googlevendor · 31
- Microsoftvendor · 28
- Claude Opus 5.5ai model · 21
- Geminiai model · 21
- Claude Codeproduct · 20
- Googleorganization · 18
- Codexproduct · 17
- Microsoftorganization · 15
- Claude Sonnet 5.5ai model · 14
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.