AhsayCBS intruders planted webshells and miners that outlast patches
Huntress found five webshell families and miners on three servers breached October 8–11, before October 12 hotfixes.
Stories per day · 30 days
2 RSS
Relatedxmrig12plex7plex2shell6dll-sideloading3webshell3yoba3ahsay2ahsaycbs2github2kev2rce2seo-poisoning2ssrf2armorsteal1authentication-bypass1backup1botnet1chatgpt1
27 stories, newest first · one card per story
Stories tagged #cryptominer
ArmorSteal steals credentials and mines Monero via fake downloads
Victims who paste a PowerShell command get a PyArmor-packed Python kit with three scheduled tasks and 11 command domains.
Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
1
Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
2
Fake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
2
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
1
CISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
Claude Code reportedly finds hidden XMRig miner on a Mac
A Reddit user says the assistant saw about 1,175% CPU use and a LaunchAgent dated August 29; the report is unverified.
Attackers use Plex2Shell to mine crypto on vulnerable Plex servers
A public proof of concept for four Plex flaws was used within a day to drop XMRig and proxy software on a honeypot.
2
Attackers exploit Plex2Shell flaws to install miners and a proxy
Four chained bugs give unauthenticated remote code execution; Plex fixed them in 1.43.3.10861 on August 3.
8
Plex Media Server flaws exploited in the wild to drop a miner
A honeypot saw RCE attempts from three IPs, then a miner and a proxy called myawesomeproxy.
2
Plex2Shell chain used against Plex servers a day after disclosure
A honeypot saw the public exploit drop an XMRig miner and later proxy software called myawesomeproxy.
4
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
4
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
SANS analyzes Panchan, a Golang cryptomining worm that still spreads by stealing SSH keys.
3
CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
Attackers are chaining AhsayCBS authentication-bypass and critical RCE flaws to deploy webshells and cryptominers.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Round 118 collects reports on ClingSTUN, npm supply-chain theft, AhsayCBS exploitation, and other malware campaigns.
6
Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers
Attackers are exploiting two AhsayCBS zero-days for unauthenticated SYSTEM access on exposed backup servers.
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Attackers exploit unpatched AhsayCBS flaws to plant JSP webshells and XMRig miners at five organizations.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Huntress says attackers are exploiting unpatched AhsayCBS flaws for unauthenticated RCE, webshells, and cryptominers.
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Huntress saw attackers chain two AhsayCBS flaws for SYSTEM RCE, webshells, and XMRig mining.
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.
7
Apple and a Hacker's Future
Attackers are exploiting macOS screen-sharing flaw CVE-2026-65400 on exposed port 5900 to install Monero miners.
6
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
Huntress says attackers used Samsung MagicINFO CVE-2025-4632 on one Windows host to compile a Monero miner.