Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
2
Stories per day · 30 days
3 RSS
Relateddll-sideloading6yoba6xmrig5chatgpt4github4claude2cryptominer2armorsteal1credential-theft1fake-ai-apps1huntress1infostealer1phishing1pyarmor1python1storm-25611typosquatting1vpn1
27 stories, newest first · one card per story
Stories tagged #seo-poisoning
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
1
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
1
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
2
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
1
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Check Point says the chain uses signed OpenAI and Anthropic binaries plus Telegram, Tor, Catbox and DNS over HTTPS.
4
SEO poisoning campaign delivers new Armorsteal malware
Fake Chocolatey and Massgrave sites installed a Python remote-access module that steals system data and runs signed tasks.
1
Fake WatchGuard VPN Site Steals Credentials
Huntress found a WatchGuard lookalike that phished VPN server, login, and password via SEO poisoning.
3
670 Jev Domains Registered After Launch as Fake AI Marketplaces Target Users
About 670 lookalike Jev domains appeared days after launch, with fake shops marking up API access.
5
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.
2
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
2
“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation
Attackers chain Google search results, a hacked Thai .ac.th domain, and redirects to push illegal casino ads past moderation, at industrialized scale across gov/edu sites.
Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino
ADEX uncovered a hacked Thai college domain serving casino pages through real Google search redirects, part of a global campaign compromising government and education sites.
Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking
Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.
1
Search results are sending people to fake Bitrefill checkouts
Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.
1
Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker
Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.
7
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
Huntress details campaigns abusing Claude Artifacts, claude.ai/share links, and ChatGPT/Grok conversations to deliver SectopRAT, MacSync, and AMOS stealers.
4
Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign
Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.
6
Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
14
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
4
BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.
2
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.
Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
2