Attackers exploit AhsayCBS flaws to hide code in PNGs and plant backdoors
Three servers in one organization were hit October 8–11, 2026, via auth bypass and unauthenticated SYSTEM RCE before hotfixes.
Stories per day · 30 days
4 RSS
Relatedcryptominer12dll-sideloading8yoba7ahsaycbs6github6chatgpt5plex5seo-poisoning5backup4plex2shell4webshell4ahsay3claude3honeypot3rce3cryptojacking2cryptomining2kev2
38 stories, newest first · one card per story
Stories tagged #xmrig
ArmorSteal steals credentials and mines Monero via fake downloads
Victims who paste a PowerShell command get a PyArmor-packed Python kit with three scheduled tasks and 11 command domains.
Hackers Exploit DLL Sideloading in OpenAI and Anthropic Binaries to Deploy YobaLoader
Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic executables to install YobaLoader and XMRig miner.
2
Yoba malware hides an XMRig miner in fake AI installers
Check Point says signed OpenAI and Anthropic binaries sideload a loader that fetches XMRig via Telegram and DNS-over-HTTPS.
2
Fake ChatGPT and Claude apps sideload miners via YobaLoader
Check Point says ZIP files pair signed OpenAI or Anthropic Setup.exe files with a malicious winmm.dll that runs XMRig.
2
Fake ChatGPT and Claude GitHub apps deliver the Yoba cryptominer
YobaLoader pulls its next stage from a Telegram profile picture and can run any executable or PowerShell script, not only XMRig.
1
Fake ChatGPT and Claude apps on GitHub spread Yoba malware
Check Point says the two-month campaign sideloads a dropper through signed binaries; the payload seen so far is an XMRig miner.
2
Fake ChatGPT and Claude apps spread malware via signed binaries
Check Point’s Yoba loader fetched XMRig and can also retrieve other Windows executables or PowerShell.
1
Fake ChatGPT and Claude GitHub apps sideload Yoba malware
Signed vendor Setup.exe files load YobaDropper, which plants a SYSTEM scheduled task; an observed payload was XMRig 6.26.0 over Tor.
2
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
1
Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
Symantec finds AI agent hijacking exposed models for autonomous attacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
5
Claude Code reportedly finds XMRig using 1175% CPU on a Mac
A Reddit user says a LaunchAgent and pool.hashvault.sh kept the miner alive; the report is unverified.
Claude Code reportedly finds hidden XMRig miner on a Mac
A Reddit user says the assistant saw about 1,175% CPU use and a LaunchAgent dated August 29; the report is unverified.
Attackers use Plex2Shell to mine crypto on vulnerable Plex servers
A public proof of concept for four Plex flaws was used within a day to drop XMRig and proxy software on a honeypot.
2
Attackers exploit Plex2Shell flaws to install miners and a proxy
Four chained bugs give unauthenticated remote code execution; Plex fixed them in 1.43.3.10861 on August 3.
8
Plex Media Server flaws exploited in the wild to drop a miner
A honeypot saw RCE attempts from three IPs, then a miner and a proxy called myawesomeproxy.
2
Plex2Shell chain used against Plex servers a day after disclosure
A honeypot saw the public exploit drop an XMRig miner and later proxy software called myawesomeproxy.
4
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
4
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ahsay re-patched exploited AhsayCBS flaws after incomplete fixes still allowed web shells and XMRig miners.
CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
Attackers are chaining AhsayCBS authentication-bypass and critical RCE flaws to deploy webshells and cryptominers.
Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners
Hackers chain two AhsayCBS flaws (CVE-2026-105133/105134) to plant webshells and cryptominers across at least five organizations.
Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers
Attackers are exploiting two AhsayCBS zero-days for unauthenticated SYSTEM access on exposed backup servers.