Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Stories per day · 30 days
7 RSS
Relatedyoba9clickfix8github8xmrig8chatgpt7seo-poisoning6claude4forescout4powershell4romulus4bronze-sandcastle3camera-software3cryptominer3huntress3legionloader3reverse-shell3siemens3active-directory2
76 stories, newest first · one card per story
Stories tagged #dll-sideloading
SlippyNunchucks deploys DarkVigil through Sogou Input Method
ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.
Hackers Abuse Signed ChatGPT and Claude Apps to Deploy Yoba Malware
Attackers distribute Yoba malware through fake signed AI application downloads using DLL sideloading on Windows systems.
1
Hackers Exploit DLL Sideloading in OpenAI and Anthropic Binaries to Deploy YobaLoader
Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic executables to install YobaLoader and XMRig miner.
2
Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
2
Fake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
2
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
1
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
2
Huntress: compromised camera software used to enter corporate networks
September and October cases show CMS.exe launching a reverse shell and sideloading DLLs through a copied WpcMon.exe.
1
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
1
Camera software used to sideload malware on Windows
Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.
2
Camera software intrusions drop reverse shells and sideloaded DLLs
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
2
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
2
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
1
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Check Point says the chain uses signed OpenAI and Anthropic binaries plus Telegram, Tor, Catbox and DNS over HTTPS.
4
Compromised camera software used to deploy malware, Huntress says
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
1
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
1
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
1
Bronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
1
Attackers exploit Siemens Software Center flaw in ClickFix campaign
CVE-2026-110936 let version 3.5.8.7 load attacker files beside a signed binary; 4.0.9.8 fixes it.
1
ClickFix attacks exploit Siemens Software Center DLL flaw to deploy a RAT
CVE-2026-110936, CVSS v4 8.4, is fixed in Siemens Software Center 4.0.9.8; abused builds sideloaded archive.dll via a signed copy.
Siemens Software Center DLL sideloading flaw exploited in the wild
CVE-2026-110936 affects Siemens Software Center before V4.0.9.8, and Siemens reports active exploitation.
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
4