Tricks from the Past deployed via signed ChatGPT and Claude binaries

A malware campaign named Yoba exploits the popularity of AI tools like ChatGPT and Claude by distributing malicious installers through fake GitHub projects. These projects mimic legitimate desktop applications and use DLL sideloading with signed executables from OpenAI and Anthropic to evade security. The malware chain includes YobaDropper and YobaLoader, which deliver unwanted software such as XMRig cryptocurrency miners. The threat actor avoids traditional command-and-control infrastructure, relying instead on Telegram, Tor, Catbox, and DNS over HTTPS. The campaign appears to originate from actors in the UTC-4 timezone with possible Russian links and excludes CIS countries from infection.

• Plex vulnerabilities being exploited in the wild to drop a cryptominerMalware2026-10-19
• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• 2026 Q3 Linux SSH Server Targeted Malware Statistics ReportMalware2026-10-14